Commit 125a0cf5 authored by Hangyu Hua's avatar Hangyu Hua Committed by Wang Liang
Browse files

net: tipc: fix possible refcount leak in tipc_sk_create() 

stable inclusion
from stable-v4.19.253
commit ef488669b2652bde5b6ee5a409a5b048a2a50db4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP398
CVE: CVE-2022-49620

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ef488669b2652bde5b6ee5a409a5b048a2a50db4



--------------------------------

[ Upstream commit 00aff359 ]

Free sk in case tipc_sk_insert() fails.

Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Reviewed-by: default avatarTung Nguyen <tung.q.nguyen@dektech.com.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWang Liang <wangliang74@huawei.com>
parent 3c67b39e

net/tipc/socket.c

+1 −0
Original line number Diff line number Diff line
@@ -453,6 +453,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, 
	sock_init_data(sock, sk);

	tipc_set_sk_state(sk, TIPC_OPEN);

	if (tipc_sk_insert(tsk)) {

		sk_free(sk);

		pr_warn("Socket create failed; port number exhausted\n");

		return -EINVAL;

	}