From mboxrd@z Thu Jan  1 00:00:00 1970
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S965400AbeAJJaN (ORCPT <rfc822;ralf@linux-mips.org> + 1 other);
        Wed, 10 Jan 2018 04:30:13 -0500
Received: from mail-lf0-f49.google.com ([209.85.215.49]:40783 "EHLO
        mail-lf0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S964950AbeAJJaH (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 10 Jan 2018 04:30:07 -0500
X-Google-Smtp-Source: ACJfBot+/1ixEZ9CZJVTW2sve+p3E8sQs99lUbE8At5YGev6jJIfPaMvfYmYeCH3CujHO7QKhhM1/w==
Subject: Re: net: memory leak in socket
To: Al Viro <viro@ZenIV.linux.org.uk>,
        David Miller <davem@davemloft.net>
Cc: netdev <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        Eric Dumazet <edumazet@google.com>,
        Willem de Bruijn <willemb@google.com>,
        syzkaller <syzkaller@googlegroups.com>,
        Dmitry Vyukov <dvyukov@google.com>
References: <CACT4Y+afcR2=wsmG_DObzG04JvVX-8X-4_zK4WYp1EAMhbbGEg@mail.gmail.com>
 <20180109185351.GE13338@ZenIV.linux.org.uk>
 <CACT4Y+Yi=CNxCo0Fg5kuTOpDjjAx1WxMzW74GDP975bJuUhdiA@mail.gmail.com>
 <20180109205303.GF13338@ZenIV.linux.org.uk>
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Message-ID: <0578c35c-43a7-ad5f-9cd9-c7ba5fde522f@cogentembedded.com>
Date: Wed, 10 Jan 2018 12:30:05 +0300
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <20180109205303.GF13338@ZenIV.linux.org.uk>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>

Hello!

On 1/9/2018 11:53 PM, Al Viro wrote:

>>> Argh...  Got broken by "make sock_alloc_file() do sock_release() on failures" -
>>> cleanup after sock_map_fd() failure got pulled all the way into sock_alloc_file(),
>>> but it used to serve the case when sock_map_fd() failed *before* getting to
>>> sock_alloc_file().
>>>
>>> Fixes: commit 8e1611e23579 (make sock_alloc_file() do sock_release() on failures)
>>> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
>>
>> Please add:
>>
>> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> 
> Sure, no problem.  Dave, which tree should that go through?  Do you pick it, or
> should I send the below directly to Linus?
> ----
> Fix a leak in socket(2) when we fail to allocate a file descriptor.
> 
> Got broken by "make sock_alloc_file() do sock_release() on failures" -
> cleanup after sock_map_fd() failure got pulled all the way into
> sock_alloc_file(), but it used to serve the case when sock_map_fd()
> failed *before* getting to sock_alloc_file() as well, and that got
> lost.  Trivial to fix, fortunately.
> 
> Fixes: commit 8e1611e23579 (make sock_alloc_file() do sock_release() on failures)

Fixes: 8e1611e23579 ("make sock_alloc_file() do sock_release() on failures")

> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[...]

MBR, Sergei