mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 14:04:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

net: fix a resource leak in copy_net_ns() error handling path

Browse Source 
Currently, preinit_net() does two things:

  (1) call ns_common_init() which might fail
  (2) initialize resources which does not fail

However, preinit_net() is returning early when (1) fails, and copy_net_ns()
is jumping to the dec_ucounts: label. As a result, resources allocated by
net_alloc() are leaking. We need to call key_remove_domain() and
net_passive_dec() in order to release resources allocated by net_alloc().

We cannot simply jump to the put_userns: label when preinit_net() failed,
for (2) is not yet done. But we can reorder (1) and (2), for there is no
dependency between (1) and (2). Therefore, this patch decouples (1) from
preinit_net() and changes preinit_net() back to a void function, and calls
ns_common_init() after preinit_net() succeeded. Then, we can jump to
immediately after ns_common_free() of the put_userns: label.

Reported-by: sashiko (no mail address)
Closes: https://sashiko.dev/#/patchset/af7dabf3-d0d7-46dc-a878-e1715b3c9ac6%40I-love.SAKURA.ne.jp
Fixes: 08027f6b79 ("net: use ns_common_init()")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://patch.msgid.link/c182cf90-1ed7-435b-88f7-9f00e88a0487@I-love.SAKURA.ne.jp
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Tetsuo Handa
2026-08-22 17:18:31 +09:00
committed by Paolo Abeni
parent 97148bcb75
commit 3220b62fbb
1 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
net/core/net_namespace.c
View File

@@ -400,14 +400,8 @@ static __net_init void preinit_net_sysctl(struct net *net)
}
/* init code that must occur even if setup_net() is not called. */
static __net_init int preinit_net(struct net *net, struct user_namespace *user_ns)
static __net_init void preinit_net(struct net *net, struct user_namespace *user_ns)
{
int ret;
ret = ns_common_init(net);
if (ret)
return ret;
refcount_set(&net->passive, 1);
ref_tracker_dir_init(&net->refcnt_tracker, 128, "net_refcnt");
ref_tracker_dir_init(&net->notrefcnt_tracker, 128, "net_notrefcnt");
@@ -431,7 +425,6 @@ static __net_init int preinit_net(struct net *net, struct user_namespace *user_n
INIT_LIST_HEAD(&net->ptype_all);
INIT_LIST_HEAD(&net->ptype_specific);
preinit_net_sysctl(net);
return 0;
}
/*
@@ -574,12 +567,14 @@ struct net *copy_net_ns(u64 flags,
goto dec_ucounts;
}
rv = preinit_net(net, user_ns);
if (rv < 0)
goto dec_ucounts;
preinit_net(net, user_ns);
net->ucounts = ucounts;
get_user_ns(user_ns);
rv = ns_common_init(net);
if (rv)
goto put_userns_no_common;
rv = down_read_killable(&pernet_ops_rwsem);
if (rv < 0)
goto put_userns;
@@ -591,6 +586,7 @@ struct net *copy_net_ns(u64 flags,
if (rv < 0) {
put_userns:
ns_common_free(net);
put_userns_no_common:
#ifdef CONFIG_KEYS
key_remove_domain(net->key_domain);
#endif
@@ -1293,7 +1289,8 @@ void __init net_ns_init(void)
* This currently cannot fail as the initial network namespace
* has a static inode number.
*/
if (preinit_net(&init_net, &init_user_ns))
preinit_net(&init_net, &init_user_ns);
if (ns_common_init(&init_net))
panic("Could not preinitialize the initial network namespace");
down_write(&pernet_ops_rwsem);