On Tue, Jan 09, 2018 at 07:58:08PM +0100, Dmitry Vyukov wrote: > > Argh... Got broken by "make sock_alloc_file() do sock_release() on > > failures" - > > cleanup after sock_map_fd() failure got pulled all the way into > > sock_alloc_file(), > > but it used to serve the case when sock_map_fd() failed *before* getting to > > sock_alloc_file(). > > > > Fixes: commit 8e1611e23579 (make sock_alloc_file() do sock_release() on > > failures) > > Signed-off-by: Al Viro <v...@zeniv.linux.org.uk> > > Please add: > > Reported-by: Dmitry Vyukov <dvyu...@google.com>
Sure, no problem. Dave, which tree should that go through? Do you pick it, or should I send the below directly to Linus? ---- Fix a leak in socket(2) when we fail to allocate a file descriptor. Got broken by "make sock_alloc_file() do sock_release() on failures" - cleanup after sock_map_fd() failure got pulled all the way into sock_alloc_file(), but it used to serve the case when sock_map_fd() failed *before* getting to sock_alloc_file() as well, and that got lost. Trivial to fix, fortunately. Fixes: commit 8e1611e23579 (make sock_alloc_file() do sock_release() on failures) Reported-by: Dmitry Vyukov <dvyu...@google.com> Signed-off-by: Al Viro <v...@zeniv.linux.org.uk> --- diff --git a/net/socket.c b/net/socket.c index bbd2e9ceb692..1536515b6437 100644 --- a/net/socket.c +++ b/net/socket.c @@ -430,8 +430,10 @@ static int sock_map_fd(struct socket *sock, int flags) { struct file *newfile; int fd = get_unused_fd_flags(flags); - if (unlikely(fd < 0)) + if (unlikely(fd < 0)) { + sock_release(sock); return fd; + } newfile = sock_alloc_file(sock, flags, NULL); if (likely(!IS_ERR(newfile))) {