tipc: fix a memory leak in tipc_nl_node_get_link()
When tipc_node_find_by_name() fails, the nlmsg is not freed. While on it, switch to a goto label to properly free it. Fixes: be9c086715c ("tipc: narrow down exposure of struct tipc_node") Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: Jon Maloy <jon.maloy@ericsson.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Acked-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
749439bfac
Коммит
59b36613e8
|
@ -1880,36 +1880,38 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info)
|
||||||
|
|
||||||
if (strcmp(name, tipc_bclink_name) == 0) {
|
if (strcmp(name, tipc_bclink_name) == 0) {
|
||||||
err = tipc_nl_add_bc_link(net, &msg);
|
err = tipc_nl_add_bc_link(net, &msg);
|
||||||
if (err) {
|
if (err)
|
||||||
nlmsg_free(msg.skb);
|
goto err_free;
|
||||||
return err;
|
|
||||||
}
|
|
||||||
} else {
|
} else {
|
||||||
int bearer_id;
|
int bearer_id;
|
||||||
struct tipc_node *node;
|
struct tipc_node *node;
|
||||||
struct tipc_link *link;
|
struct tipc_link *link;
|
||||||
|
|
||||||
node = tipc_node_find_by_name(net, name, &bearer_id);
|
node = tipc_node_find_by_name(net, name, &bearer_id);
|
||||||
if (!node)
|
if (!node) {
|
||||||
return -EINVAL;
|
err = -EINVAL;
|
||||||
|
goto err_free;
|
||||||
|
}
|
||||||
|
|
||||||
tipc_node_read_lock(node);
|
tipc_node_read_lock(node);
|
||||||
link = node->links[bearer_id].link;
|
link = node->links[bearer_id].link;
|
||||||
if (!link) {
|
if (!link) {
|
||||||
tipc_node_read_unlock(node);
|
tipc_node_read_unlock(node);
|
||||||
nlmsg_free(msg.skb);
|
err = -EINVAL;
|
||||||
return -EINVAL;
|
goto err_free;
|
||||||
}
|
}
|
||||||
|
|
||||||
err = __tipc_nl_add_link(net, &msg, link, 0);
|
err = __tipc_nl_add_link(net, &msg, link, 0);
|
||||||
tipc_node_read_unlock(node);
|
tipc_node_read_unlock(node);
|
||||||
if (err) {
|
if (err)
|
||||||
nlmsg_free(msg.skb);
|
goto err_free;
|
||||||
return err;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
return genlmsg_reply(msg.skb, info);
|
return genlmsg_reply(msg.skb, info);
|
||||||
|
|
||||||
|
err_free:
|
||||||
|
nlmsg_free(msg.skb);
|
||||||
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
int tipc_nl_node_reset_link_stats(struct sk_buff *skb, struct genl_info *info)
|
int tipc_nl_node_reset_link_stats(struct sk_buff *skb, struct genl_info *info)
|
||||||
|
|
Загрузка…
Ссылка в новой задаче