Re: net: memory leak in socket

[Al Viro]

On Tue, Jan 09, 2018 at 07:58:08PM +0100, Dmitry Vyukov wrote:
> > Argh...  Got broken by "make sock_alloc_file() do sock_release() on failures" -
> > cleanup after sock_map_fd() failure got pulled all the way into sock_alloc_file(),
> > but it used to serve the case when sock_map_fd() failed *before* getting to
> > sock_alloc_file().
> >
> > Fixes: commit 8e1611e23579 (make sock_alloc_file() do sock_release() on failures)
> > Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> 
> Please add:
> 
> Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>

Sure, no problem.  Dave, which tree should that go through?  Do you pick it, or
should I send the below directly to Linus?
----
Fix a leak in socket(2) when we fail to allocate a file descriptor.

Got broken by "make sock_alloc_file() do sock_release() on failures" -
cleanup after sock_map_fd() failure got pulled all the way into
sock_alloc_file(), but it used to serve the case when sock_map_fd()
failed *before* getting to sock_alloc_file() as well, and that got
lost.  Trivial to fix, fortunately.

Fixes: commit 8e1611e23579 (make sock_alloc_file() do sock_release() on failures)
Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
---
diff --git a/net/socket.c b/net/socket.c
index bbd2e9ceb692..1536515b6437 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -430,8 +430,10 @@ static int sock_map_fd(struct socket *sock, int flags)
 {
 	struct file *newfile;
 	int fd = get_unused_fd_flags(flags);
-	if (unlikely(fd < 0))
+	if (unlikely(fd < 0)) {
+		sock_release(sock);
 		return fd;
+	}
 
 	newfile = sock_alloc_file(sock, flags, NULL);
 	if (likely(!IS_ERR(newfile))) {