[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <alpine.OSX.2.22.394.2006121151020.74555@mjmartin-mac01.local>
Date: Fri, 12 Jun 2020 12:14:38 -0700 (PDT)
From: Mat Martineau <mathew.j.martineau@...ux.intel.com>
To: Wei Yongjun <weiyongjun1@...wei.com>
cc: netdev@...r.kernel.org,
Matthieu Baerts <matthieu.baerts@...sares.net>,
mptcp@...ts.01.org
Subject: Re: [PATCH] mptcp: fix memory leak in
mptcp_subflow_create_socket()
Hello Wei,
On Fri, 12 Jun 2020, Wei Yongjun wrote:
> socket malloced by sock_create_kern() should be release before return
> in the error handling, otherwise it cause memory leak.
>
> unreferenced object 0xffff88810910c000 (size 1216):
> comm "00000003_test_m", pid 12238, jiffies 4295050289 (age 54.237s)
> hex dump (first 32 bytes):
> 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 2f 30 0a 81 88 ff ff ........./0.....
> backtrace:
> [<00000000e877f89f>] sock_alloc_inode+0x18/0x1c0
> [<0000000093d1dd51>] alloc_inode+0x63/0x1d0
> [<000000005673fec6>] new_inode_pseudo+0x14/0xe0
> [<00000000b5db6be8>] sock_alloc+0x3c/0x260
> [<00000000e7e3cbb2>] __sock_create+0x89/0x620
> [<0000000023e48593>] mptcp_subflow_create_socket+0xc0/0x5e0
> [<00000000419795e4>] __mptcp_socket_create+0x1ad/0x3f0
> [<00000000b2f942e8>] mptcp_stream_connect+0x281/0x4f0
> [<00000000c80cd5cc>] __sys_connect_file+0x14d/0x190
> [<00000000dc761f11>] __sys_connect+0x128/0x160
> [<000000008b14e764>] __x64_sys_connect+0x6f/0xb0
> [<000000007b4f93bd>] do_syscall_64+0xa1/0x530
> [<00000000d3e770b6>] entry_SYSCALL_64_after_hwframe+0x49/0xb3
>
> Fixes: 2303f994b3e1 ("mptcp: Associate MPTCP context with TCP socket")
> Signed-off-by: Wei Yongjun <weiyongjun1@...wei.com>
>
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index bf132575040d..bbdb74b8bc3c 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -1053,8 +1053,10 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock)
> err = tcp_set_ulp(sf->sk, "mptcp");
> release_sock(sf->sk);
>
> - if (err)
> + if (err) {
> + sock_release(sf);
> return err;
> + }
>
> /* the newly created socket really belongs to the owning MPTCP master
> * socket, even if for additional subflows the allocation is performed
> --
> 2.25.1
Thanks for catching this leak. Be sure to specify which git tree this
should be applied to in the subject line, I'm assuming in this case you'd
want [PATCH net].
--
Mat Martineau
Intel
Powered by blists - more mailing lists