From cd05a0eca8752c63bf79c10ae1a877d36cca995a Mon Sep 17 00:00:00 2001 From: Cyrill Gorcunov Date: Wed, 2 Nov 2016 15:36:31 +0300 Subject: [PATCH 1/2] net: ip, raw_diag -- Fix socket leaking for destroy request In raw_diag_destroy the helper raw_sock_get returns with sock_hold call, so we have to put it then. CC: David S. Miller CC: Eric Dumazet CC: David Ahern CC: Andrey Vagin CC: Stephen Hemminger Signed-off-by: Cyrill Gorcunov Acked-by: David Ahern Signed-off-by: David S. Miller --- net/ipv4/raw_diag.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c index be930908bcf98..bf0b8842bf31f 100644 --- a/net/ipv4/raw_diag.c +++ b/net/ipv4/raw_diag.c @@ -205,11 +205,14 @@ static int raw_diag_destroy(struct sk_buff *in_skb, { struct net *net = sock_net(in_skb->sk); struct sock *sk; + int err; sk = raw_sock_get(net, r); if (IS_ERR(sk)) return PTR_ERR(sk); - return sock_diag_destroy(sk, ECONNABORTED); + err = sock_diag_destroy(sk, ECONNABORTED); + sock_put(sk); + return err; } #endif From 9999370faed945be2913cd34aa24e84317a0ceda Mon Sep 17 00:00:00 2001 From: Cyrill Gorcunov Date: Wed, 2 Nov 2016 15:36:32 +0300 Subject: [PATCH 2/2] net: ip, raw_diag -- Use jump for exiting from nested loop I managed to miss that sk_for_each is called under "for" cycle so need to use goto here to return matching socket. CC: David S. Miller CC: Eric Dumazet CC: David Ahern CC: Andrey Vagin CC: Stephen Hemminger Signed-off-by: Cyrill Gorcunov Acked-by: David Ahern Signed-off-by: David S. Miller --- net/ipv4/raw_diag.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c index bf0b8842bf31f..e1a51ca68d23c 100644 --- a/net/ipv4/raw_diag.c +++ b/net/ipv4/raw_diag.c @@ -79,10 +79,11 @@ static struct sock *raw_sock_get(struct net *net, const struct inet_diag_req_v2 * hashinfo->lock here. */ sock_hold(sk); - break; + goto out_unlock; } } } +out_unlock: read_unlock(&hashinfo->lock); return sk ? sk : ERR_PTR(-ENOENT);