Skip to content

Commit 3b09ff5

Browse files
ISCAS-Vulabkuba-moo
authored andcommitted
net: qrtr: fix node refcount leak on ctrl packet alloc failure
qrtr_send_resume_tx() calls qrtr_node_lookup() which takes a reference on the returned node. If the subsequent call to qrtr_alloc_ctrl_packet() fails due to memory allocation failure, the function returns -ENOMEM without calling qrtr_node_release() to release the node reference. Add qrtr_node_release(node) before returning on the allocation failure path to properly release the reference. Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260528080019.1176700-1-vulab@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent e3c6508 commit 3b09ff5

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

net/qrtr/af_qrtr.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1009,8 +1009,10 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb)
10091009
return -EINVAL;
10101010

10111011
skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
1012-
if (!skb)
1012+
if (!skb) {
1013+
qrtr_node_release(node);
10131014
return -ENOMEM;
1015+
}
10141016

10151017
pkt->cmd = cpu_to_le32(QRTR_TYPE_RESUME_TX);
10161018
pkt->client.node = cpu_to_le32(cb->dst_node);

0 commit comments

Comments
 (0)