From 0ceaa66c393bb7e59126e66d578dd2b8431c2a49 Mon Sep 17 00:00:00 2001 From: Jesse Gross Date: Tue, 21 Aug 2012 17:48:54 -0700 Subject: [PATCH] datapath: Fix namespace refcount leak on failed init. If a datapath fails to initialze fully (likely due to out-of-memory) then it's possible that we can take a reference to a network namespace but never release it. This fixes the problem by releasing any resources in the event of an error. Found by code inspection, it's likely to be extremely rare in practice. Signed-off-by: Jesse Gross Acked-by: Pravin B Shelar --- datapath/datapath.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/datapath/datapath.c b/datapath/datapath.c index e98c84b2..c83ce167 100644 --- a/datapath/datapath.c +++ b/datapath/datapath.c @@ -1407,6 +1407,8 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) dp->ifobj.kset = NULL; kobject_init(&dp->ifobj, &dp_ktype); + ovs_dp_set_net(dp, hold_net(sock_net(skb->sk))); + /* Allocate table. */ err = -ENOMEM; rcu_assign_pointer(dp->table, ovs_flow_tbl_alloc(TBL_MIN_BUCKETS)); @@ -1418,7 +1420,6 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) err = -ENOMEM; goto err_destroy_table; } - ovs_dp_set_net(dp, hold_net(sock_net(skb->sk))); dp->ports = kmalloc(DP_VPORT_HASH_BUCKETS * sizeof(struct hlist_head), GFP_KERNEL); @@ -1473,6 +1474,7 @@ err_destroy_percpu: err_destroy_table: ovs_flow_tbl_destroy(genl_dereference(dp->table)); err_free_dp: + release_net(ovs_dp_get_net(dp)); kfree(dp); err_unlock_rtnl: rtnl_unlock(); -- 2.30.2