[PATCH net] net: mctp: put sock on tag allocation failure

[PATCH net] net: mctp: put sock on tag allocation failure

[Jeremy Kerr]

We may hold an extra reference on a socket if a tag allocation fails: we
optimistically allocate the sk_key, and take a ref there, but do not
drop if we end up not using the allocated key.

Ensure we're dropping the sock on this failure by doing a proper unref
rather than directly kfree()ing.

Fixes: de8a6b15d965 ("net: mctp: add an explicit reference from a mctp_sk_key to sock")
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
---
 net/mctp/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mctp/route.c b/net/mctp/route.c
index a64788bc40a8..8594bf256e7d 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -663,7 +663,7 @@ struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk,
 	spin_unlock_irqrestore(&mns->keys_lock, flags);
 
 	if (!tagbits) {
-		kfree(key);
+		mctp_key_unref(key);
 		return ERR_PTR(-EBUSY);
 	}
 
-- 
2.39.2

Re: [PATCH net] net: mctp: put sock on tag allocation failure

[Simon Horman]

On Thu, Feb 15, 2024 at 03:53:08PM +0800, Jeremy Kerr wrote:
> We may hold an extra reference on a socket if a tag allocation fails: we
> optimistically allocate the sk_key, and take a ref there, but do not
> drop if we end up not using the allocated key.
> 
> Ensure we're dropping the sock on this failure by doing a proper unref
> rather than directly kfree()ing.
> 
> Fixes: de8a6b15d965 ("net: mctp: add an explicit reference from a mctp_sk_key to sock")
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] net: mctp: put sock on tag allocation failure

[Jakub Kicinski]

On Thu, 15 Feb 2024 15:53:08 +0800 Jeremy Kerr wrote:
> We may hold an extra reference on a socket if a tag allocation fails: we
> optimistically allocate the sk_key, and take a ref there, but do not
> drop if we end up not using the allocated key.
> 
> Ensure we're dropping the sock on this failure by doing a proper unref
> rather than directly kfree()ing.
> 
> Fixes: de8a6b15d965 ("net: mctp: add an explicit reference from a mctp_sk_key to sock")
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>

Hi Jeremy!

This patch is good to be applied, right?
It got marked Not Applicable in patchwork, not sure why.

Re: [PATCH net] net: mctp: put sock on tag allocation failure

[Jeremy Kerr]

Hi Jakub,

> This patch is good to be applied, right?

Yep, all good on my side!

> It got marked Not Applicable in patchwork, not sure why.

Also not sure what happened there - I hadn't set that myself, at least!

Cheers,


Jeremy

Re: [PATCH net] net: mctp: put sock on tag allocation failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 15 Feb 2024 15:53:08 +0800 you wrote:
> We may hold an extra reference on a socket if a tag allocation fails: we
> optimistically allocate the sk_key, and take a ref there, but do not
> drop if we end up not using the allocated key.
> 
> Ensure we're dropping the sock on this failure by doing a proper unref
> rather than directly kfree()ing.
> 
> [...]

Here is the summary with links:
  - [net] net: mctp: put sock on tag allocation failure
    https://git.kernel.org/netdev/net/c/9990889be142

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html