diff mbox series

[5.15,47/72] phonet: refcount leak in pep_sock_accep

Message ID	20220110071823.142663066@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Hangyu Hua <hbh25y@gmail.com>, Jakub Kicinski <kuba@kernel.org>, Aayush Agarwal <aayush.a.agarwal@oracle.com> Subject: [PATCH 5.15 47/72] phonet: refcount leak in pep_sock_accep Date: Mon, 10 Jan 2022 08:23:24 +0100 Message-Id: <20220110071823.142663066@linuxfoundation.org> In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,02/72] selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() [5.15,04/72] tracing: Tag trace_percpu_buffer as a percpu pointer [5.15,06/72] ieee802154: atusb: fix uninit value in atusb_set_extended_addr [5.15,07/72] i40e: Fix to not show opcode msg on unsuccessful VF MAC change [5.15,10/72] Revert "net: usb: r8152: Add MAC passthrough support for more Lenovo Docks" [5.15,11/72] netrom: fix copying in user data in nr_setsockopt [5.15,15/72] sfc: The RX page_ring is optional [5.15,17/72] i40e: Fix for displaying message regarding NVM version [5.15,18/72] i40e: Fix incorrect netdevs real number of RX/TX queues [5.15,21/72] ipv4: Check attribute length for RTA_FLOW in multipath route [5.15,23/72] ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route [5.15,24/72] lwtunnel: Validate RTA_ENCAP_TYPE attribute length [5.15,26/72] sctp: hold endpoint before calling cb in sctp_transport_lookup_process [5.15,28/72] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc [5.15,29/72] net: ena: Fix undefined state when tx request id is out of bounds [5.15,31/72] net: ena: Fix error handling when calculating max IO queues number [5.15,33/72] EDAC/i10nm: Release mdev/mbase when failing to detect HBM [5.15,36/72] cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv [5.15,37/72] cgroup: Use open-time cgroup namespace for process migration perm checks [5.15,39/72] i2c: mpc: Avoid out of bounds memory access [5.15,43/72] reset: renesas: Fix Runtime PM usage [5.15,44/72] rndis_host: support Hytera digital radios [5.15,46/72] net ticp:fix a kernel-infoleak in __tipc_sendmsg() [5.15,47/72] phonet: refcount leak in pep_sock_accep [5.15,51/72] ipv6: Continue processing multipath route even if gateway attribute is invalid [5.15,53/72] auxdisplay: charlcd: checking for pointer reference before dereferencing [5.15,55/72] drm/amd/pm: Fix xgmi link control on aldebaran [5.15,60/72] atlantic: Fix buff_ring OOB in aq_ring_rx_clean [5.15,61/72] drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume [5.15,63/72] drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform [5.15,64/72] mISDN: change function names to avoid conflicts [5.15,65/72] drm/amd/display: fix B0 TMDS deepcolor no dislay issue [5.15,67/72] ipv6: raw: check passed optlen before reading [5.15,68/72] userfaultfd/selftests: fix hugetlb area allocations [5.15,71/72] Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)"

Commit Message

Greg KH Jan. 10, 2022, 7:23 a.m. UTC

From: Hangyu Hua <hbh25y@gmail.com>

commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream.

sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not
invoked in subsequent failure branches(pep_accept_conn() != 0).

Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Aayush Agarwal <aayush.a.agarwal@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/phonet/pep.c |    1 +
 1 file changed, 1 insertion(+)

diff mbox series

Patch

--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -868,6 +868,7 @@  static struct sock *pep_sock_accept(stru
 
 	err = pep_accept_conn(newsk, skb);
 	if (err) {
+		__sock_put(sk);
 		sock_put(newsk);
 		newsk = NULL;
 		goto drop;