Commit c96b6acc authored by Wang Hai's avatar Wang Hai Committed by David S. Miller

dccp: Fix possible memleak in dccp_init and dccp_fini

There are some memory leaks in dccp_init() and dccp_fini().

In dccp_fini() and the error handling path in dccp_init(), free lhash2
is missing. Add inet_hashinfo2_free_mod() to do it.

If inet_hashinfo2_init_mod() failed in dccp_init(),
percpu_counter_destroy() should be called to destroy dccp_orphan_count.
It need to goto out_free_percpu when inet_hashinfo2_init_mod() failed.

Fixes: c92c81df ("net: dccp: fix kernel crash on module load")
Reported-by: default avatarHulk Robot <hulkci@huawei.com>
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 976ee3b2
...@@ -185,6 +185,12 @@ static inline spinlock_t *inet_ehash_lockp( ...@@ -185,6 +185,12 @@ static inline spinlock_t *inet_ehash_lockp(
int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo); int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo);
static inline void inet_hashinfo2_free_mod(struct inet_hashinfo *h)
{
kfree(h->lhash2);
h->lhash2 = NULL;
}
static inline void inet_ehash_locks_free(struct inet_hashinfo *hashinfo) static inline void inet_ehash_locks_free(struct inet_hashinfo *hashinfo)
{ {
kvfree(hashinfo->ehash_locks); kvfree(hashinfo->ehash_locks);
......
...@@ -1139,14 +1139,14 @@ static int __init dccp_init(void) ...@@ -1139,14 +1139,14 @@ static int __init dccp_init(void)
inet_hashinfo_init(&dccp_hashinfo); inet_hashinfo_init(&dccp_hashinfo);
rc = inet_hashinfo2_init_mod(&dccp_hashinfo); rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
if (rc) if (rc)
goto out_fail; goto out_free_percpu;
rc = -ENOBUFS; rc = -ENOBUFS;
dccp_hashinfo.bind_bucket_cachep = dccp_hashinfo.bind_bucket_cachep =
kmem_cache_create("dccp_bind_bucket", kmem_cache_create("dccp_bind_bucket",
sizeof(struct inet_bind_bucket), 0, sizeof(struct inet_bind_bucket), 0,
SLAB_HWCACHE_ALIGN, NULL); SLAB_HWCACHE_ALIGN, NULL);
if (!dccp_hashinfo.bind_bucket_cachep) if (!dccp_hashinfo.bind_bucket_cachep)
goto out_free_percpu; goto out_free_hashinfo2;
/* /*
* Size and allocate the main established and bind bucket * Size and allocate the main established and bind bucket
...@@ -1242,6 +1242,8 @@ static int __init dccp_init(void) ...@@ -1242,6 +1242,8 @@ static int __init dccp_init(void)
free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order); free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
out_free_bind_bucket_cachep: out_free_bind_bucket_cachep:
kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep); kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
out_free_hashinfo2:
inet_hashinfo2_free_mod(&dccp_hashinfo);
out_free_percpu: out_free_percpu:
percpu_counter_destroy(&dccp_orphan_count); percpu_counter_destroy(&dccp_orphan_count);
out_fail: out_fail:
...@@ -1265,6 +1267,7 @@ static void __exit dccp_fini(void) ...@@ -1265,6 +1267,7 @@ static void __exit dccp_fini(void)
kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep); kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
dccp_ackvec_exit(); dccp_ackvec_exit();
dccp_sysctl_exit(); dccp_sysctl_exit();
inet_hashinfo2_free_mod(&dccp_hashinfo);
percpu_counter_destroy(&dccp_orphan_count); percpu_counter_destroy(&dccp_orphan_count);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment