rxrpc: Fix leak of rxrpc_peer objects

When a new client call is requested, an rxrpc_conn_parameters struct object
is passed in with a bunch of parameters set, such as the local endpoint to
use.  A pointer to the target peer record is also placed in there by
rxrpc_get_client_conn() - and this is removed if and only if a new
connection object is allocated.  Thus it leaks if a new connection object
isn't allocated.

Fix this by putting any peer object attached to the rxrpc_conn_parameters
object in the function that allocated it.

Fixes: 19ffa01c9c45 ("rxrpc: Use structs to hold connection params and protocol info")
Signed-off-by: David Howells <dhowells@redhat.com>

diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 0b3026b8fa40007fb6bbd733f7be720bb95ed04e..9a2c8e7c000e6ad21858b082fa2e8aa5a295114e 100644 (file)
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -324,6 +324,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                mutex_unlock(&call->user_mutex);
        }
 
+       rxrpc_put_peer(cp.peer);
        _leave(" = %p", call);
        return call;
 }
@@ -447,6 +448,7 @@ int rxrpc_kernel_retry_call(struct socket *sock, struct rxrpc_call *call,
                ret = rxrpc_retry_client_call(rx, call, &cp, srx, GFP_KERNEL);
 
        mutex_unlock(&call->user_mutex);
+       rxrpc_put_peer(cp.peer);
        _leave(" = %d", ret);
        return ret;
 }

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index c46583bc255d863fd5eaf295616b1fdfc7852160..90d7079e0aa99327ced07c61d4c8e315fbe26f8d 100644 (file)
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -1041,6 +1041,7 @@ struct rxrpc_peer *rxrpc_lookup_peer(struct rxrpc_local *,
 struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *, gfp_t);
 struct rxrpc_peer *rxrpc_lookup_incoming_peer(struct rxrpc_local *,
                                              struct rxrpc_peer *);
+void rxrpc_destroy_all_peers(struct rxrpc_net *);
 struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
 struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
 void rxrpc_put_peer(struct rxrpc_peer *);

diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c
index fa9ce60e7bfa598029e6de402111f94281071381..c7a023fb22d036010895656626a1559336e36359 100644 (file)
--- a/net/rxrpc/net_ns.c
+++ b/net/rxrpc/net_ns.c
@@ -118,6 +118,7 @@ static __net_exit void rxrpc_exit_net(struct net *net)
        cancel_work_sync(&rxnet->peer_keepalive_work);
        rxrpc_destroy_all_calls(rxnet);
        rxrpc_destroy_all_connections(rxnet);
+       rxrpc_destroy_all_peers(rxnet);
        rxrpc_destroy_all_locals(rxnet);
        proc_remove(rxnet->proc_net);
 }

diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index a4a750aea1e535d46a9200c1f9c027a542da2ba9..1b7e8107b3ae8a144bc72d01f6e1277368b3cbad 100644 (file)
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -463,6 +463,27 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
        }
 }
 
+/*
+ * Make sure all peer records have been discarded.
+ */
+void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
+{
+       struct rxrpc_peer *peer;
+       int i;
+
+       for (i = 0; i < HASH_SIZE(rxnet->peer_hash); i++) {
+               if (hlist_empty(&rxnet->peer_hash[i]))
+                       continue;
+
+               hlist_for_each_entry(peer, &rxnet->peer_hash[i], hash_link) {
+                       pr_err("Leaked peer %u {%u} %pISp\n",
+                              peer->debug_id,
+                              atomic_read(&peer->usage),
+                              &peer->srx.transport);
+               }
+       }
+}
+
 /**
  * rxrpc_kernel_get_peer - Get the peer address of a call
  * @sock: The socket on which the call is in progress.

diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index a62980a801517741d7220299606492cbbb0f6dc7..206e802ccbdc1a588ad26e13ff5f7e66afa6c4bb 100644 (file)
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -586,6 +586,7 @@ rxrpc_new_client_call_for_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg,
                                     atomic_inc_return(&rxrpc_debug_id));
        /* The socket is now unlocked */
 
+       rxrpc_put_peer(cp.peer);
        _leave(" = %p\n", call);
        return call;
 }