| Message ID | 20220810152909.25149-1-xiongx18@fudan.edu.cn (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Wed, 10 Aug 2022 23:29:13 +0800 you wrote: > The issue happens on some error handling paths. When the function > fails to grab the object `xprt`, it simply returns 0, forgetting to > decrease the reference count of another object `xps`, which is > increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount > leaks. Also, the function forgets to check whether `xps` is valid > before using it, which may result in NULL-dereferencing issues. > > [...] Here is the summary with links: - net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() https://git.kernel.org/netdev/net/c/bfc48f1b0505 You are awesome, thank you!
diff --git a/net/sunrpc/sysfs.c b/net/sunrpc/sysfs.c index a3a2f8aeb80e..d1a15c6d3fd9 100644 --- a/net/sunrpc/sysfs.c +++ b/net/sunrpc/sysfs.c @@ -291,8 +291,10 @@ static ssize_t rpc_sysfs_xprt_state_change(struct kobject *kobj, int offline = 0, online = 0, remove = 0; struct rpc_xprt_switch *xps = rpc_sysfs_xprt_kobj_get_xprt_switch(kobj); - if (!xprt) - return 0; + if (!xprt || !xps) { + count = 0; + goto out_put; + } if (!strncmp(buf, "offline", 7)) offline = 1;
The issue happens on some error handling paths. When the function fails to grab the object `xprt`, it simply returns 0, forgetting to decrease the reference count of another object `xps`, which is increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount leaks. Also, the function forgets to check whether `xps` is valid before using it, which may result in NULL-dereferencing issues. Fix it by adding proper error handling code when either `xprt` or `xps` is NULL. Fixes: 5b7eb78486cd ("SUNRPC: take a xprt offline using sysfs") Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn> Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> --- net/sunrpc/sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)