path: root/net/ipv4/tcp_diag.c
diff options
authorDavid Ahern <dsa@cumulusnetworks.com>2016-08-23 21:05:27 -0700
committerDavid S. Miller <davem@davemloft.net>2016-08-23 23:11:36 -0700
commitd7226c7a4dd19929d6df4ae04698da2fcf6f875a (patch)
tree33b158ecdb0ed30ca22110588dc368b91a10f9ed /net/ipv4/tcp_diag.c
parenttun: fix transmit timestamp support (diff)
net: diag: Fix refcnt leak in error path destroying socket
inet_diag_find_one_icsk takes a reference to a socket that is not released if sock_diag_destroy returns an error. Fix by changing tcp_diag_destroy to manage the refcnt for all cases and remove the sock_put calls from tcp_abort. Fixes: c1e64e298b8ca ("net: diag: Support destroying TCP sockets") Reported-by: Lorenzo Colitti <lorenzo@google.com> Signed-off-by: David Ahern <dsa@cumulusnetworks.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_diag.c')
1 files changed, 6 insertions, 1 deletions
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 4d610934fb39..a748c74aa8b7 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -54,11 +54,16 @@ static int tcp_diag_destroy(struct sk_buff *in_skb,
struct net *net = sock_net(in_skb->sk);
struct sock *sk = inet_diag_find_one_icsk(net, &tcp_hashinfo, req);
+ int err;
if (IS_ERR(sk))
return PTR_ERR(sk);
- return sock_diag_destroy(sk, ECONNABORTED);
+ err = sock_diag_destroy(sk, ECONNABORTED);
+ sock_gen_put(sk);
+ return err;