tipc: fix memory leak in tipc_topsrv_start()

[ Upstream commit fa6882c63621821f73cc806f291208e1c6ea6187 ]

kmemleak report a memory leak as follows:

unreferenced object 0xffff88810a596800 (size 512):
  comm "ip", pid 21558, jiffies 4297568990 (age 112.120s)
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff 00 83 60 b0 ff ff ff ff  ..........`.....
  backtrace:
    [<0000000022bbe21f>] tipc_topsrv_init_net+0x1f3/0xa70
    [<00000000fe15ddf7>] ops_init+0xa8/0x3c0
    [<00000000138af6f2>] setup_net+0x2de/0x7e0
    [<000000008c6807a3>] copy_net_ns+0x27d/0x530
    [<000000006b21adbd>] create_new_namespaces+0x382/0xa30
    [<00000000bb169746>] unshare_nsproxy_namespaces+0xa1/0x1d0
    [<00000000fe2e42bc>] ksys_unshare+0x39c/0x780
    [<0000000009ba3b19>] __x64_sys_unshare+0x2d/0x40
    [<00000000614ad866>] do_syscall_64+0x56/0xa0
    [<00000000a1b5ca3c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

'srv' is malloced in tipc_topsrv_start() but not free before
leaving from the error handling cases. We need to free it.

Fixes: 5c45ab24ac77 ("tipc: make struct tipc_server private for server.c")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201109140913.47370-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
index 1489cfb941d8ef0d83cbc567fcf1e989c3b58e21..d29b962264c3d8cf7579b8d967ceabca5161a164 100644 (file)
--- a/net/tipc/topsrv.c
+++ b/net/tipc/topsrv.c
@@ -665,12 +665,18 @@ static int tipc_topsrv_start(struct net *net)
 
        ret = tipc_topsrv_work_start(srv);
        if (ret < 0)
-               return ret;
+               goto err_start;
 
        ret = tipc_topsrv_create_listener(srv);
        if (ret < 0)
-               tipc_topsrv_work_stop(srv);
+               goto err_create;
 
+       return 0;
+
+err_create:
+       tipc_topsrv_work_stop(srv);
+err_start:
+       kfree(srv);
        return ret;
 }