Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59b36613 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller
Browse files

tipc: fix a memory leak in tipc_nl_node_get_link() 



When tipc_node_find_by_name() fails, the nlmsg is not
freed.

While on it, switch to a goto label to properly
free it.

Fixes: be9c086715c ("tipc: narrow down exposure of struct tipc_node")
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Acked-by: default avatarYing Xue <ying.xue@windriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 749439bf

net/tipc/node.c

+14 −12
Original line number Diff line number Diff line
@@ -1880,36 +1880,38 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info) 


	if (strcmp(name, tipc_bclink_name) == 0) {

		err = tipc_nl_add_bc_link(net, &msg);

		if (err) {

			nlmsg_free(msg.skb);

			return err;

		}

		if (err)

			goto err_free;

	} else {

		int bearer_id;

		struct tipc_node *node;

		struct tipc_link *link;



		node = tipc_node_find_by_name(net, name, &bearer_id);

		if (!node)

			return -EINVAL;

		if (!node) {

			err = -EINVAL;

			goto err_free;

		}



		tipc_node_read_lock(node);

		link = node->links[bearer_id].link;

		if (!link) {

			tipc_node_read_unlock(node);

			nlmsg_free(msg.skb);

			return -EINVAL;

			err = -EINVAL;

			goto err_free;

		}



		err = __tipc_nl_add_link(net, &msg, link, 0);

		tipc_node_read_unlock(node);

		if (err) {

			nlmsg_free(msg.skb);

			return err;

		}

		if (err)

			goto err_free;

	}



	return genlmsg_reply(msg.skb, info);



err_free:

	nlmsg_free(msg.skb);

	return err;

}



int tipc_nl_node_reset_link_stats(struct sk_buff *skb, struct genl_info *info)