Re: [Patch net] cls_cgroup: fix memory leak in cls_cgroup_change()

[Thomas Graf <tgraf@suug.ch>]

On 01/06/14 at 03:23pm, Cong Wang wrote:
> On Fri, Jan 3, 2014 at 6:02 PM, David Miller <davem@davemloft.net> wrote:
> > From: Cong Wang <xiyou.wangcong@gmail.com>
> > Date: Fri,  3 Jan 2014 11:13:19 -0800
> >
> >> Fix it by moving allocation to ->init().
> >>
> >> Cc: Thomas Graf <tgraf@suug.ch>
> >> Cc: David S. Miller <davem@davemloft.net>
> >> Cc: Jamal Hadi Salim <jhs@mojatatu.com>
> >> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
> >
> > I don't understand how the memory leak can happen, please explain
> > it in your commit message.
> >
> 
> The leak happens when ->change() fails after the allocation
> inside  cls_cgroup_change(), its caller only does cleanup
> when itself creates one. So, the callee should do cleanup
> on error path by itself. But I may miss something.
> 
> Since it is not urgent at all, I will explain this in changelog
> and resend it for net-next.

I have no problem with the intent of the change but I want to
note that the behavior was introduced intentionally to be in
line with behaviour of other classifiers that use chaining.

It's not a leak, the reference is kept and freed when the
chain itself is deleted.