{"id":1161349,"url":"http://patchwork.ozlabs.org/api/patches/1161349/?format=json","web_url":"http://patchwork.ozlabs.org/project/netdev/patch/20190912040219.67517-4-maowenan@huawei.com/","project":{"id":7,"url":"http://patchwork.ozlabs.org/api/projects/7/?format=json","name":"Linux network development","link_name":"netdev","list_id":"netdev.vger.kernel.org","list_email":"netdev@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20190912040219.67517-4-maowenan@huawei.com>","list_archive_url":null,"date":"2019-09-12T04:02:19","name":"[v2,net,3/3] sctp: destroy bucket if failed to bind addr","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"f6525573c9b61303fc436e0380d19278f97f8f20","submitter":{"id":70289,"url":"http://patchwork.ozlabs.org/api/people/70289/?format=json","name":"maowenan","email":"maowenan@huawei.com"},"delegate":{"id":34,"url":"http://patchwork.ozlabs.org/api/users/34/?format=json","username":"davem","first_name":"David","last_name":"Miller","email":"davem@davemloft.net"},"mbox":"http://patchwork.ozlabs.org/project/netdev/patch/20190912040219.67517-4-maowenan@huawei.com/mbox/","series":[{"id":130322,"url":"http://patchwork.ozlabs.org/api/series/130322/?format=json","web_url":"http://patchwork.ozlabs.org/project/netdev/list/?series=130322","date":"2019-09-12T04:02:16","name":"fix memory leak for sctp_do_bind","version":2,"mbox":"http://patchwork.ozlabs.org/series/130322/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/1161349/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/1161349/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"patchwork-incoming-netdev@ozlabs.org","Delivered-To":"patchwork-incoming-netdev@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org;\n\tdmarc=none (p=none dis=none) header.from=huawei.com"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 46TPmM5vS9z9sNk\n\tfor ;\n\tThu, 12 Sep 2019 13:45:07 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1729803AbfILDpG (ORCPT\n\t);\n\tWed, 11 Sep 2019 23:45:06 -0400","from szxga05-in.huawei.com ([45.249.212.191]:2267 \"EHLO huawei.com\"\n\trhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP\n\tid S1727873AbfILDpF (ORCPT );\n\tWed, 11 Sep 2019 23:45:05 -0400","from DGGEMS407-HUB.china.huawei.com (unknown [172.30.72.58])\n\tby Forcepoint Email with ESMTP id D6A97EC9127A2D852B99;\n\tThu, 12 Sep 2019 11:45:03 +0800 (CST)","from localhost.localdomain.localdomain (10.175.113.25) by\n\tDGGEMS407-HUB.china.huawei.com (10.3.19.207) with Microsoft SMTP\n\tServer id 14.3.439.0; Thu, 12 Sep 2019 11:44:53 +0800"],"From":"Mao Wenan ","To":", ,\n\t, ","CC":", ,\n\t, ,\n\tMao Wenan , Hulk Robot ","Subject":"[PATCH v2 net 3/3] sctp: destroy bucket if failed to bind addr","Date":"Thu, 12 Sep 2019 12:02:19 +0800","Message-ID":"<20190912040219.67517-4-maowenan@huawei.com>","X-Mailer":"git-send-email 2.20.1","In-Reply-To":"<20190912040219.67517-1-maowenan@huawei.com>","References":"<7a450679-40ca-8a84-4cba-7a16f22ea3c0@huawei.com>\n\t<20190912040219.67517-1-maowenan@huawei.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"7BIT","Content-Type":"text/plain; charset=US-ASCII","X-Originating-IP":"[10.175.113.25]","X-CFilter-Loop":"Reflected","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"},"content":"There is one memory leak bug report:\nBUG: memory leak\nunreferenced object 0xffff8881dc4c5ec0 (size 40):\n comm \"syz-executor.0\", pid 5673, jiffies 4298198457 (age 27.578s)\n hex dump (first 32 bytes):\n 02 00 00 00 81 88 ff ff 00 00 00 00 00 00 00 00 ................\n f8 63 3d c1 81 88 ff ff 00 00 00 00 00 00 00 00 .c=.............\n backtrace:\n [<0000000072006339>] sctp_get_port_local+0x2a1/0xa00 [sctp]\n [<00000000c7b379ec>] sctp_do_bind+0x176/0x2c0 [sctp]\n [<000000005be274a2>] sctp_bind+0x5a/0x80 [sctp]\n [<00000000b66b4044>] inet6_bind+0x59/0xd0 [ipv6]\n [<00000000c68c7f42>] __sys_bind+0x120/0x1f0 net/socket.c:1647\n [<000000004513635b>] __do_sys_bind net/socket.c:1658 [inline]\n [<000000004513635b>] __se_sys_bind net/socket.c:1656 [inline]\n [<000000004513635b>] __x64_sys_bind+0x3e/0x50 net/socket.c:1656\n [<0000000061f2501e>] do_syscall_64+0x72/0x2e0 arch/x86/entry/common.c:296\n [<0000000003d1e05e>] entry_SYSCALL_64_after_hwframe+0x49/0xbe\n\nThis is because in sctp_do_bind, if sctp_get_port_local is to\ncreate hash bucket successfully, and sctp_add_bind_addr failed\nto bind address, e.g return -ENOMEM, so memory leak found, it\nneeds to destroy allocated bucket.\n\nReported-by: Hulk Robot \nSigned-off-by: Mao Wenan \nAcked-by: Neil Horman \n---\n net/sctp/socket.c | 10 ++++++----\n 1 file changed, 6 insertions(+), 4 deletions(-)","diff":"diff --git a/net/sctp/socket.c b/net/sctp/socket.c\nindex 2f810078c91d..69ec3b796197 100644\n--- a/net/sctp/socket.c\n+++ b/net/sctp/socket.c\n@@ -412,11 +412,13 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)\n \tret = sctp_add_bind_addr(bp, addr, af->sockaddr_len,\n \t\t\t\t SCTP_ADDR_SRC, GFP_ATOMIC);\n \n-\t/* Copy back into socket for getsockname() use. */\n-\tif (!ret) {\n-\t\tinet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);\n-\t\tsp->pf->to_sk_saddr(addr, sk);\n+\tif (ret) {\n+\t\tsctp_put_port(sk);\n+\t\treturn ret;\n \t}\n+\t/* Copy back into socket for getsockname() use. */\n+\tinet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);\n+\tsp->pf->to_sk_saddr(addr, sk);\n \n \treturn ret;\n }\n","prefixes":["v2","net","3/3"]}