diff options
| author | David Ahern <dsa@cumulusnetworks.com> | 2016-08-23 21:05:27 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-08-23 23:11:36 -0700 |
| commit | d7226c7a4dd19929d6df4ae04698da2fcf6f875a (patch) | |
| tree | 33b158ecdb0ed30ca22110588dc368b91a10f9ed /net/ipv4/tcp_diag.c | |
| parent | 7b996243fab46092fb3a29c773c54be8152366e4 (diff) | |
| download | lwn-d7226c7a4dd19929d6df4ae04698da2fcf6f875a.tar.gz lwn-d7226c7a4dd19929d6df4ae04698da2fcf6f875a.zip | |
net: diag: Fix refcnt leak in error path destroying socket
inet_diag_find_one_icsk takes a reference to a socket that is not
released if sock_diag_destroy returns an error. Fix by changing
tcp_diag_destroy to manage the refcnt for all cases and remove
the sock_put calls from tcp_abort.
Fixes: c1e64e298b8ca ("net: diag: Support destroying TCP sockets")
Reported-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_diag.c')
| -rw-r--r-- | net/ipv4/tcp_diag.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c index 4d610934fb39..a748c74aa8b7 100644 --- a/net/ipv4/tcp_diag.c +++ b/net/ipv4/tcp_diag.c @@ -54,11 +54,16 @@ static int tcp_diag_destroy(struct sk_buff *in_skb, { struct net *net = sock_net(in_skb->sk); struct sock *sk = inet_diag_find_one_icsk(net, &tcp_hashinfo, req); + int err; if (IS_ERR(sk)) return PTR_ERR(sk); - return sock_diag_destroy(sk, ECONNABORTED); + err = sock_diag_destroy(sk, ECONNABORTED); + + sock_gen_put(sk); + + return err; } #endif |