Commit 2a6a811a authored Dec 09, 2021 by Hangyu Hua Committed by Greg Kroah-Hartman Jan 11, 2022

phonet: refcount leak in pep_sock_accep



commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream.

sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not
invoked in subsequent failure branches(pep_accept_conn() != 0).

Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Aayush Agarwal <aayush.a.agarwal@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent db0c834a

net/phonet/pep.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -868,6 +868,7 @@ static struct sock pep_sock_accept(struct sock sk, int flags, int *errp,

		err = pep_accept_conn(newsk, skb);
		if (err) {
		__sock_put(sk);
		sock_put(newsk);
		newsk = NULL;
		goto drop;