diff options
author | Cong Wang <cwang@twopensource.com> | 2014-10-14 15:35:08 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2014-10-14 17:00:19 -0400 |
commit | dee49f203a7feef5d00c416b7dc7e34a7caba8e1 (patch) | |
tree | f3ba47780b9bc7362479f3caae851fe527543f35 /net | |
parent | 22c0b963d7400971f4c5a1a67b083e3742996640 (diff) |
rds: avoid calling sock_kfree_s() on allocation failure
It is okay to free a NULL pointer but not okay to mischarge the socket optmem
accounting. Compile test only.
Reported-by: rucsoftsec@gmail.com
Cc: Chien Yen <chien.yen@oracle.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/rds/rdma.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/rds/rdma.c b/net/rds/rdma.c index 4e37c1cbe8b2..40084d843e9f 100644 --- a/net/rds/rdma.c +++ b/net/rds/rdma.c | |||
@@ -564,12 +564,12 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm, | |||
564 | 564 | ||
565 | if (rs->rs_bound_addr == 0) { | 565 | if (rs->rs_bound_addr == 0) { |
566 | ret = -ENOTCONN; /* XXX not a great errno */ | 566 | ret = -ENOTCONN; /* XXX not a great errno */ |
567 | goto out; | 567 | goto out_ret; |
568 | } | 568 | } |
569 | 569 | ||
570 | if (args->nr_local > UIO_MAXIOV) { | 570 | if (args->nr_local > UIO_MAXIOV) { |
571 | ret = -EMSGSIZE; | 571 | ret = -EMSGSIZE; |
572 | goto out; | 572 | goto out_ret; |
573 | } | 573 | } |
574 | 574 | ||
575 | /* Check whether to allocate the iovec area */ | 575 | /* Check whether to allocate the iovec area */ |
@@ -578,7 +578,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm, | |||
578 | iovs = sock_kmalloc(rds_rs_to_sk(rs), iov_size, GFP_KERNEL); | 578 | iovs = sock_kmalloc(rds_rs_to_sk(rs), iov_size, GFP_KERNEL); |
579 | if (!iovs) { | 579 | if (!iovs) { |
580 | ret = -ENOMEM; | 580 | ret = -ENOMEM; |
581 | goto out; | 581 | goto out_ret; |
582 | } | 582 | } |
583 | } | 583 | } |
584 | 584 | ||
@@ -696,6 +696,7 @@ out: | |||
696 | if (iovs != iovstack) | 696 | if (iovs != iovstack) |
697 | sock_kfree_s(rds_rs_to_sk(rs), iovs, iov_size); | 697 | sock_kfree_s(rds_rs_to_sk(rs), iovs, iov_size); |
698 | kfree(pages); | 698 | kfree(pages); |
699 | out_ret: | ||
699 | if (ret) | 700 | if (ret) |
700 | rds_rdma_free_op(op); | 701 | rds_rdma_free_op(op); |
701 | else | 702 | else |