Re: [PATCH] sock: fix potential memory leak in proto_register()

[David Miller]

From: zhanglin 
Date: Mon, 19 Aug 2019 09:35:56 +0800

> If protocols registered exceeded PROTO_INUSE_NR, prot will be
> added to proto_list, but no available bit left for prot in
> proto_inuse_idx.
> 
> Signed-off-by: zhanglin 

This won't build with CONFIG_PROC_FS disabled.

[PATCH] sock: fix potential memory leak in proto_register()

[zhanglin]

If protocols registered exceeded PROTO_INUSE_NR, prot will be
added to proto_list, but no available bit left for prot in
proto_inuse_idx.

Signed-off-by: zhanglin 
---
 net/core/sock.c | 21 ++---
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/net/core/sock.c b/net/core/sock.c
index bc3512f230a3..25388d429f6a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3139,16 +3139,17 @@ static __init int net_inuse_init(void)
 
 core_initcall(net_inuse_init);
 
-static void assign_proto_idx(struct proto *prot)
+static int assign_proto_idx(struct proto *prot)
 {
prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
 
if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
pr_err("PROTO_INUSE_NR exhausted\n");
-   return;
+   return -ENOSPC;
}
 
set_bit(prot->inuse_idx, proto_inuse_idx);
+   return 0;
 }
 
 static void release_proto_idx(struct proto *prot)
@@ -3243,18 +3244,24 @@ int proto_register(struct proto *prot, int alloc_slab)
}
 
mutex_lock(_list_mutex);
+   if (assign_proto_idx(prot)) {
+   mutex_unlock(_list_mutex);
+   goto out_free_timewait_sock_slab_name;
+   }
list_add(>node, _list);
-   assign_proto_idx(prot);
mutex_unlock(_list_mutex);
return 0;
 
 out_free_timewait_sock_slab_name:
-   kfree(prot->twsk_prot->twsk_slab_name);
+   if (alloc_slab && prot->twsk_prot)
+   kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
-   req_prot_cleanup(prot->rsk_prot);
+   if (alloc_slab) {
+   req_prot_cleanup(prot->rsk_prot);
 
-   kmem_cache_destroy(prot->slab);
-   prot->slab = NULL;
+   kmem_cache_destroy(prot->slab);
+   prot->slab = NULL;
+   }
 out:
return -ENOBUFS;
 }
-- 
2.17.1