Patchwork xfrm: fix a possible leak of dev reference count.

login
register
mail settings
Submitter ZhangJieJing
Date Aug. 8, 2010, 1:34 p.m.
Message ID <AANLkTi==t8MGGLDxMLZsHtRoLqwhgNskU83wBw7-+ZyJ@mail.gmail.com>
Download mbox | patch
Permalink /patch/61210/
State Rejected
Delegated to: David Miller
Headers show

Comments

ZhangJieJing - Aug. 8, 2010, 1:34 p.m.
call dev_put(dev) on error path.

Signed-off-by: JieJing.Zhang <kzjeef@gmail.com>
---
 net/ipv4/xfrm4_policy.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

 	if (rt->peer)
David Miller - Aug. 9, 2010, 3:17 a.m.
From: Zhang JieJing <kzjeef@gmail.com>
Date: Sun, 8 Aug 2010 21:34:12 +0800

> call dev_put(dev) on error path.
> 
> Signed-off-by: JieJing.Zhang <kzjeef@gmail.com>

There is no leak, the caller will dst_free() the dst and at
such time the device at dst->dev will be released.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 1705476..d2a4873 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -81,8 +81,10 @@  static int xfrm4_fill_dst(struct xfrm_dst *xdst,
struct net_device *dev,
 	dev_hold(dev);

 	xdst->u.rt.idev = in_dev_get(dev);
-	if (!xdst->u.rt.idev)
+	if (!xdst->u.rt.idev) {
+		dev_put(dev);
 		return -ENODEV;
+	}

 	xdst->u.rt.peer = rt->peer;