diff options
| author | Xin Xiong <xiongx18@fudan.edu.cn> | 2020-07-29 21:06:59 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-21 11:01:55 +0200 |
| commit | c8313917127de5c264fe0589bac85cb90de25838 (patch) | |
| tree | efab7d55b9dd6c8db87f53df554ef2d18dd22778 | |
| parent | 137e399ea8e04017e9d826eac62b6cc6fd4910fa (diff) | |
| download | linux-stable-c8313917127de5c264fe0589bac85cb90de25838.tar.gz linux-stable-c8313917127de5c264fe0589bac85cb90de25838.tar.bz2 linux-stable-c8313917127de5c264fe0589bac85cb90de25838.zip | |
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
[ Upstream commit 51875dad43b44241b46a569493f1e4bfa0386d86 ]
atmtcp_remove_persistent() invokes atm_dev_lookup(), which returns a
reference of atm_dev with increased refcount or NULL if fails.
The refcount leaks issues occur in two error handling paths. If
dev_data->persist is zero or PRIV(dev)->vcc isn't NULL, the function
returns 0 without decreasing the refcount kept by a local variable,
resulting in refcount leaks.
Fix the issue by adding atm_dev_put() before returning 0 both when
dev_data->persist is zero or PRIV(dev)->vcc isn't NULL.
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/atm/atmtcp.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c index 480fa6ffbc09..04fca6db273e 100644 --- a/drivers/atm/atmtcp.c +++ b/drivers/atm/atmtcp.c @@ -432,9 +432,15 @@ static int atmtcp_remove_persistent(int itf) return -EMEDIUMTYPE; } dev_data = PRIV(dev); - if (!dev_data->persist) return 0; + if (!dev_data->persist) { + atm_dev_put(dev); + return 0; + } dev_data->persist = 0; - if (PRIV(dev)->vcc) return 0; + if (PRIV(dev)->vcc) { + atm_dev_put(dev); + return 0; + } kfree(dev_data); atm_dev_put(dev); atm_dev_deregister(dev); |