Re: [PATCH] packet: fix dev refcnt leak when bind fail

[David Miller <davem@davemloft.net>]

From: Wei Yongjun <weiyj.lk@gmail.com>
Date: Tue, 27 Dec 2011 12:28:31 +0800

> cc netdev@vger.kernel.org
> 
>> From: Wei Yongjun <weiyj.lk@gmail.com>
>> Date: Mon, 26 Dec 2011 17:02:59 +0800
>>
>>> From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>>>
>>> If bind is fail such as bind is called after set PACKET_FANOUT
>>> sock option, the dev refcnt will leak.
>>>
>>> Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
>>
>> The device pointer is stored in ->prot_hook.dev
>>
>> Therefore, it will be released at the latest in packet_release() or
>> earlier if another bind() attempt is done on the socket.
>>
>> There is no leak here as far as I can see.
> 
> Hi David,
> 
> In packet_do_bind(), if po->fanout is set, the device pointer may not be
> stored in ->prot_hook.dev, see the following code:
> 
> static int packet_do_bind(struct sock *sk, struct net_device *dev, ...)
> {
>    struct packet_sock *po = pkt_sk(sk);
> 
>    if (po->fanout)
>        return -EINVAL;
>    ...
>    po->prot_hook.dev = dev;
>    ...
> }
> 
> The leak is exists only if po->fanout is set.

Then it sounds a lot simpler for packet_do_bind() (one location) to
manage this reference drop, rather than every single call site of
packet_do_bind().

Look how complicated you had to make the tests in those call sites
to get the logic right, it's must easier to just add the dev_put()
right at that po->fanout test.