[rds-devel] [Patch net] rds: avoid calling sock_kfree_s() on allocation failure

[David Miller]

From: Cong Wang <xiyou.wangcong at gmail.com>
Date: Tue, 14 Oct 2014 12:35:08 -0700

> From: Cong Wang <cwang at twopensource.com>
> 
> It is okay to free a NULL pointer but not okay to mischarge the socket optmem
> accounting. Compile test only.
> 
> Reported-by: rucsoftsec at gmail.com
> Cc: Chien Yen <chien.yen at oracle.com>
> Cc: Stephen Hemminger <stephen at networkplumber.org>
> Signed-off-by: Cong Wang <cwang at twopensource.com>
> Signed-off-by: Cong Wang <xiyou.wangcong at gmail.com>

Applied, and I'm going to add the following bug check to the tree too.

====================
[PATCH] net: Trap attempts to call sock_kfree_s() with a NULL pointer.

Unlike normal kfree() it is never right to call sock_kfree_s() with
a NULL pointer, because sock_kfree_s() also has the side effect of
discharging the memory from the sockets quota.

Signed-off-by: David S. Miller <davem at davemloft.net>
---
 net/core/sock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/sock.c b/net/core/sock.c
index b4f3ea2..15e0c67 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1718,6 +1718,8 @@ EXPORT_SYMBOL(sock_kmalloc);
  */
 void sock_kfree_s(struct sock *sk, void *mem, int size)
 {
+	if (WARN_ON_ONCE(!mem))
+		return;
 	kfree(mem);
 	atomic_sub(size, &sk->sk_omem_alloc);
 }
-- 
1.7.11.7