Commit 3acf3783 authored Jan 04, 2023 by Zhengchao Shao Committed by Greg Kroah-Hartman Jan 18, 2023

caif: fix memory leak in cfctrl_linkup_request()



[ Upstream commit fe69230f05897b3de758427b574fc98025dfc907 ]

When linktype is unknown or kzalloc failed in cfctrl_linkup_request(),
pkt is not released. Add release process to error path.

Fixes: b482cd20 ("net-caif: add CAIF core protocol stack")
Fixes: 8d545c8f ("caif: Disconnect without waiting for response")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20230104065146.1153009-1-shaozhengchao@huawei.com


Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 02ffb4ec

net/caif/cfctrl.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -269,11 +269,15 @@ int cfctrl_linkup_request(struct cflayer *layer,
		default:
		pr_warn("Request setup of bad link type = %d\n",
		param->linktype);
		cfpkt_destroy(pkt);
		return -EINVAL;
		}
		req = kzalloc(sizeof(*req), GFP_KERNEL);
		if (!req)
		if (!req) {
		cfpkt_destroy(pkt);
		return -ENOMEM;
		}

		req->client_layer = user_layer;
		req->cmd = CFCTRL_CMD_LINK_SETUP;
		req->param = *param;