Subject: Potential memory leak in htab_map_update_elem?

From: Kris Van Hees <[email-masked]>
Date: Fri, 11 Jan 2019 00:08:04 -0500

Maybe I am missing something trivial here, but it looks to me that there is
a leak of htab elements in htab_map_update_elem when you are updating an
existing element.  After the new element is linked into the bucket list, the
following code snippet is found:

        if (l_old) {
                hlist_nulls_del_rcu(&l_old->hash_node);
                if (!htab_is_prealloc(htab))
                        free_htab_elem(htab, l_old);
        }

Nothing is done with l_old in the remainder of the function, and to me this
looks like that element is be leaked if the htab is preallocated because we
never add it to the free list.  In fact, free_htab_elem() contains the very
conditional that handles the two cases (preallocated vs non-preallocated.

	Cheers,
	Kris