net: qrtr: free memory on error path in radix_tree_insert()

commit 29de68c2b32ce58d64dea496d281e25ad0f551bd upstream.

Function radix_tree_insert() returns errors if the node hasn't
been initialized and added to the tree.

"kfree(node)" and return value "NULL" of node_get() help
to avoid using unclear node in other calls.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: <stable@vger.kernel.org> # 5.7
Fixes: c2942963826d ("net: qrtr: Migrate nameservice to kernel from userspace")
Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://lore.kernel.org/r/20230125134831.8090-1-n.petrova@fintech.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
index 1990d496fcfc0003ecc93b67f7a7a740c36cc39b..e595079c2cafe8bea4078223170b79b4e003ce3f 100644 (file)
--- a/net/qrtr/ns.c
+++ b/net/qrtr/ns.c
@@ -83,7 +83,10 @@ static struct qrtr_node *node_get(unsigned int node_id)
 
        node->id = node_id;
 
-       radix_tree_insert(&nodes, node_id, node);
+       if (radix_tree_insert(&nodes, node_id, node)) {
+               kfree(node);
+               return NULL;
+       }
 
        return node;
 }