Skip to content

Commit dee49f2

Browse files
congwang1986davem330
authored andcommitted
rds: avoid calling sock_kfree_s() on allocation failure
It is okay to free a NULL pointer but not okay to mischarge the socket optmem accounting. Compile test only. Reported-by: rucsoftsec@gmail.com Cc: Chien Yen <chien.yen@oracle.com> Cc: Stephen Hemminger <stephen@networkplumber.org> Signed-off-by: Cong Wang <cwang@twopensource.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 22c0b96 commit dee49f2

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

net/rds/rdma.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -564,12 +564,12 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
564564

565565
if (rs->rs_bound_addr == 0) {
566566
ret = -ENOTCONN; /* XXX not a great errno */
567-
goto out;
567+
goto out_ret;
568568
}
569569

570570
if (args->nr_local > UIO_MAXIOV) {
571571
ret = -EMSGSIZE;
572-
goto out;
572+
goto out_ret;
573573
}
574574

575575
/* Check whether to allocate the iovec area */
@@ -578,7 +578,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
578578
iovs = sock_kmalloc(rds_rs_to_sk(rs), iov_size, GFP_KERNEL);
579579
if (!iovs) {
580580
ret = -ENOMEM;
581-
goto out;
581+
goto out_ret;
582582
}
583583
}
584584

@@ -696,6 +696,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
696696
if (iovs != iovstack)
697697
sock_kfree_s(rds_rs_to_sk(rs), iovs, iov_size);
698698
kfree(pages);
699+
out_ret:
699700
if (ret)
700701
rds_rdma_free_op(op);
701702
else

0 commit comments

Comments
 (0)