Commit 1913109c authored by Zhengchao Shao's avatar Zhengchao Shao Committed by zhaoxiaoqiang11
Browse files

caif: fix memory leak in cfctrl_linkup_request() 

stable inclusion
from stable-v5.10.163
commit 84b2cc7b36b7f6957d307fb3d01603f93cb2d655
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7PJ9N

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=84b2cc7b36b7f6957d307fb3d01603f93cb2d655



----------------------------------------------------

[ Upstream commit fe69230f ]

When linktype is unknown or kzalloc failed in cfctrl_linkup_request(),
pkt is not released. Add release process to error path.

Fixes: b482cd20 ("net-caif: add CAIF core protocol stack")
Fixes: 8d545c8f ("caif: Disconnect without waiting for response")
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: default avatarJiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20230104065146.1153009-1-shaozhengchao@huawei.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarzhaoxiaoqiang11 <zhaoxiaoqiang11@jd.com>
parent f004d34d

net/caif/cfctrl.c

+5 −1
Original line number Diff line number Diff line
@@ -269,11 +269,15 @@ int cfctrl_linkup_request(struct cflayer *layer, 
	default:

		pr_warn("Request setup of bad link type = %d\n",

			param->linktype);

		cfpkt_destroy(pkt);

		return -EINVAL;

	}

	req = kzalloc(sizeof(*req), GFP_KERNEL);

	if (!req)

	if (!req) {

		cfpkt_destroy(pkt);

		return -ENOMEM;

	}



	req->client_layer = user_layer;

	req->cmd = CFCTRL_CMD_LINK_SETUP;

	req->param = *param;