Commit 776d794f authored by Xiyu Yang's avatar Xiyu Yang Committed by Anna Schumaker
Browse files

net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change 



The refcount leak issues take place in an error handling path. When the
3rd argument buf doesn't match with "offline", "online" or "remove", the
function simply returns -EINVAL and forgets to decrease the reference
count of a rpc_xprt object and a rpc_xprt_switch object increased by
rpc_sysfs_xprt_kobj_get_xprt() and
rpc_sysfs_xprt_kobj_get_xprt_switch(), causing reference count leaks of
both unused objects.

Fix this issue by jumping to the error handling path labelled with
out_put when buf matches none of "offline", "online" or "remove".

Signed-off-by: default avatarXiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: default avatarXin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: default avatarXin Tan <tanxin.ctf@gmail.com>
Signed-off-by: default avatarAnna Schumaker <Anna.Schumaker@Netapp.com>
parent 4ca9f31a

net/sunrpc/sysfs.c

+4 −2
Original line number Diff line number Diff line
@@ -295,8 +295,10 @@ static ssize_t rpc_sysfs_xprt_state_change(struct kobject *kobj, 
		online = 1;

	else if (!strncmp(buf, "remove", 6))

		remove = 1;

	else

		return -EINVAL;

	else {

		count = -EINVAL;

		goto out_put;

	}



	if (wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_KILLABLE)) {

		count = -EINTR;