diff mbox series

[5.4,26/34] phonet: refcount leak in pep_sock_accep

Message ID	20220110071816.552824354@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Hangyu Hua <hbh25y@gmail.com>, Jakub Kicinski <kuba@kernel.org>, Aayush Agarwal <aayush.a.agarwal@oracle.com> Subject: [PATCH 5.4 26/34] phonet: refcount leak in pep_sock_accep Date: Mon, 10 Jan 2022 08:23:21 +0100 Message-Id: <20220110071816.552824354@linuxfoundation.org> In-Reply-To: <20220110071815.647309738@linuxfoundation.org> References: <20220110071815.647309738@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,02/34] Input: touchscreen - Fix backport of a02dcde595f7cbd240ccd64de96034ad91cffc40 [5.4,03/34] selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() [5.4,07/34] iavf: Fix limit of total number of queues to active queues of VF [5.4,09/34] RDMA/uverbs: Check for null return of kmalloc_array [5.4,11/34] i40e: fix use-after-free in i40e_sync_filters_subtask() [5.4,12/34] i40e: Fix for displaying message regarding NVM version [5.4,13/34] i40e: Fix incorrect netdevs real number of RX/TX queues [5.4,14/34] ipv4: Check attribute length for RTA_GATEWAY in multipath route [5.4,16/34] ipv6: Check attribute length for RTA_GATEWAY in multipath route [5.4,20/34] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc [5.4,22/34] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate [5.4,23/34] power: supply: core: Break capacity loop [5.4,24/34] power: reset: ltc2952: Fix use of floating point literals [5.4,26/34] phonet: refcount leak in pep_sock_accep [5.4,27/34] ipv6: Continue processing multipath route even if gateway attribute is invalid [5.4,28/34] ipv6: Do cleanup if attribute validation fails in multipath route [5.4,29/34] usb: mtu3: fix interval value for intr and isoc [5.4,31/34] ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate [5.4,33/34] atlantic: Fix buff_ring OOB in aq_ring_rx_clean

Commit Message

Greg KH Jan. 10, 2022, 7:23 a.m. UTC

From: Hangyu Hua <hbh25y@gmail.com>

commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream.

sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not
invoked in subsequent failure branches(pep_accept_conn() != 0).

Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Aayush Agarwal <aayush.a.agarwal@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/phonet/pep.c |    1 +
 1 file changed, 1 insertion(+)

diff mbox series

Patch

--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -868,6 +868,7 @@  static struct sock *pep_sock_accept(stru
 
 	err = pep_accept_conn(newsk, skb);
 	if (err) {
+		__sock_put(sk);
 		sock_put(newsk);
 		newsk = NULL;
 		goto drop;