Skip to content

Commit 67c6fc9

Browse files
wangxiaoming321gregkh
authored andcommitted
net: ipv4: current group_info should be put after using.
[ Upstream commit b04c461 ] Plug a group_info refcount leak in ping_init. group_info is only needed during initialization and the code failed to release the reference on exit. While here move grabbing the reference to a place where it is actually needed. Signed-off-by: Chuansheng Liu <[email protected]> Signed-off-by: Zhang Dongxing <[email protected]> Signed-off-by: xiaoming wang <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 6392b26 commit 67c6fc9

File tree

1 file changed

+11
-4
lines changed

1 file changed

+11
-4
lines changed

net/ipv4/ping.c

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -203,26 +203,33 @@ static int ping_init_sock(struct sock *sk)
203203
struct net *net = sock_net(sk);
204204
gid_t group = current_egid();
205205
gid_t range[2];
206-
struct group_info *group_info = get_current_groups();
207-
int i, j, count = group_info->ngroups;
206+
struct group_info *group_info;
207+
int i, j, count;
208+
int ret = 0;
208209

209210
inet_get_ping_group_range_net(net, range, range+1);
210211
if (range[0] <= group && group <= range[1])
211212
return 0;
212213

214+
group_info = get_current_groups();
215+
count = group_info->ngroups;
213216
for (i = 0; i < group_info->nblocks; i++) {
214217
int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
215218

216219
for (j = 0; j < cp_count; j++) {
217220
group = group_info->blocks[i][j];
218221
if (range[0] <= group && group <= range[1])
219-
return 0;
222+
goto out_release_group;
220223
}
221224

222225
count -= cp_count;
223226
}
224227

225-
return -EACCES;
228+
ret = -EACCES;
229+
230+
out_release_group:
231+
put_group_info(group_info);
232+
return ret;
226233
}
227234

228235
static void ping_close(struct sock *sk, long timeout)

0 commit comments

Comments
 (0)