]> git.baikalelectronics.ru Git - kernel.git/commit
tipc: Fix potential tipc_node refcnt leak in tipc_rcv
authorXiyu Yang <xiyuyang19@fudan.edu.cn>
Wed, 15 Apr 2020 08:40:28 +0000 (16:40 +0800)
committerDavid S. Miller <davem@davemloft.net>
Sat, 18 Apr 2020 20:24:20 +0000 (13:24 -0700)
commitd85022de622b8c9b67e318f5f303b57b0e07f59f
tree0735bb70564a33dce45033a01cc227e3e33a37e2
parentc78f22ce19a71fb57826bf852a868c92e3363f3a
tipc: Fix potential tipc_node refcnt leak in tipc_rcv

tipc_rcv() invokes tipc_node_find() twice, which returns a reference of
the specified tipc_node object to "n" with increased refcnt.

When tipc_rcv() returns or a new object is assigned to "n", the original
local reference of "n" becomes invalid, so the refcount should be
decreased to keep refcount balanced.

The issue happens in some paths of tipc_rcv(), which forget to decrease
the refcnt increased by tipc_node_find() and will cause a refcnt leak.

Fix this issue by calling tipc_node_put() before the original object
pointed by "n" becomes invalid.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/tipc/node.c