net: qrtr: Fix memory leak on qrtr_tx_wait failure
[ Upstream commitpull/305/head^28a03dd9257
] qrtr_tx_wait does not check for radix_tree_insert failure, causing the 'flow' object to be unreferenced after qrtr_tx_wait return. Fix that by releasing flow on radix_tree_insert failure. Fixes:5fdeb0d372
("net: qrtr: Implement outgoing flow control") Reported-by: syzbot+739016799a89c530b32a@syzkaller.appspotmail.com Signed-off-by: Loic Poulain <loic.poulain@linaro.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
parent
dfe7805e6a
commit
6af631d1ca
|
@ -266,7 +266,10 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
|
|||
flow = kzalloc(sizeof(*flow), GFP_KERNEL);
|
||||
if (flow) {
|
||||
init_waitqueue_head(&flow->resume_tx);
|
||||
radix_tree_insert(&node->qrtr_tx_flow, key, flow);
|
||||
if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
|
||||
kfree(flow);
|
||||
flow = NULL;
|
||||
}
|
||||
}
|
||||
}
|
||||
mutex_unlock(&node->qrtr_tx_lock);
|
||||
|
|
Loading…
Reference in New Issue