Commit 8a03dd92 authored by Loic Poulain's avatar Loic Poulain Committed by David S. Miller
Browse files

net: qrtr: Fix memory leak on qrtr_tx_wait failure 



qrtr_tx_wait does not check for radix_tree_insert failure, causing
the 'flow' object to be unreferenced after qrtr_tx_wait return. Fix
that by releasing flow on radix_tree_insert failure.

Fixes: 5fdeb0d3 ("net: qrtr: Implement outgoing flow control")
Reported-by: default avatar <syzbot+739016799a89c530b32a@syzkaller.appspotmail.com>
Signed-off-by: default avatarLoic Poulain <loic.poulain@linaro.org>
Reviewed-by: default avatarBjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: default avatarManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6855e821

net/qrtr/qrtr.c

+4 −1
Original line number Diff line number Diff line
@@ -271,7 +271,10 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port, 
		flow = kzalloc(sizeof(*flow), GFP_KERNEL);

		if (flow) {

			init_waitqueue_head(&flow->resume_tx);

			radix_tree_insert(&node->qrtr_tx_flow, key, flow);

			if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {

				kfree(flow);

				flow = NULL;

			}

		}

	}

	mutex_unlock(&node->qrtr_tx_lock);