From: Ralf Baechle <ralf@linux-mips.org>
To: Patrick McHardy <kaber@trash.net>
Cc: Ben Greear <greearb@candelatech.com>,
linux-hams@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: Netdevice reference leak in af_ax25.c ??
Date: Thu, 1 Sep 2005 20:30:08 +0100 [thread overview]
Message-ID: <20050901193008.GA13363@linux-mips.org> (raw)
In-Reply-To: <43174ED3.6040106@trash.net>
On Thu, Sep 01, 2005 at 08:56:19PM +0200, Patrick McHardy wrote:
> > I believe the SO_BINDTODEVICE case in net/ax25/af_x25.c (line 613 or so)
> > leaks a reference to a net device. It does a dev_get_by_name,
> > which holds a reference, but since it never assigns the pointer
> > anywhere, I do not see how it can ever free it later.
> >
> > Please clue me in as to where it's released if it actually is.
>
> I can't find the code you're talking about, there's no dev_get* in my
> version of af_x25.c. Please paste the code you're talking about in
> your bugreports, thanks.
Ben meant net/ax25/af_ax25. The dev value is stored in the ax25_cb
indirectly after converting it to an ax25dev pointer and will be freed
what that ax25_cb (which really is the protocol-specific part of the
socket) is going to be closed.
You poked my nose at a bug though - it is possible to leak references by
performing multiple SO_BINDTODEVICE operations; we should either only
permit the first one to succeed or to drop the reference of the old
device in case of a repeated SO_BINDTODEVICE. After the weekend ...
Ralf
next prev parent reply other threads:[~2005-09-01 19:30 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-09-01 18:41 Netdevice reference leak in af_ax25.c ?? Ben Greear
2005-09-01 18:56 ` Patrick McHardy
2005-09-01 19:02 ` Ben Greear
2005-09-01 19:30 ` Ralf Baechle [this message]
2005-09-01 19:42 ` Ben Greear
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050901193008.GA13363@linux-mips.org \
--to=ralf@linux-mips.org \
--cc=greearb@candelatech.com \
--cc=kaber@trash.net \
--cc=linux-hams@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).