* [PATCH] net: qrtr: fix refcount leak in qrtr_send_resume_tx()
@ 2026-06-11 17:07 WenTao Liang
2026-06-13 7:51 ` Simon Horman
0 siblings, 1 reply; 2+ messages in thread
From: WenTao Liang @ 2026-06-11 17:07 UTC (permalink / raw)
To: mani, davem, edumazet, kuba, pabeni
Cc: horms, linux-arm-msm, netdev, linux-kernel, WenTao Liang, stable
qrtr_send_resume_tx() acquires a node reference via qrtr_node_lookup().
If the subsequent qrtr_alloc_ctrl_packet() allocation fails, the
function returns -ENOMEM without releasing the reference. This results
in a reference count leak.
Fix it by adding the missing qrtr_node_release(node) call on the error
path.
Cc: stable@vger.kernel.org
Fixes: cb6530b99faf ("net: qrtr: Move resume-tx transmission to recvmsg")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
net/qrtr/af_qrtr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 7cec6a7859b0..c9f892427f7c 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -1009,8 +1009,10 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb)
return -EINVAL;
skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
- if (!skb)
+ if (!skb) {
+ qrtr_node_release(node);
return -ENOMEM;
+ }
pkt->cmd = cpu_to_le32(QRTR_TYPE_RESUME_TX);
pkt->client.node = cpu_to_le32(cb->dst_node);
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] net: qrtr: fix refcount leak in qrtr_send_resume_tx()
2026-06-11 17:07 [PATCH] net: qrtr: fix refcount leak in qrtr_send_resume_tx() WenTao Liang
@ 2026-06-13 7:51 ` Simon Horman
0 siblings, 0 replies; 2+ messages in thread
From: Simon Horman @ 2026-06-13 7:51 UTC (permalink / raw)
To: WenTao Liang
Cc: mani, davem, edumazet, kuba, pabeni, linux-arm-msm, netdev,
linux-kernel, stable
On Fri, Jun 12, 2026 at 01:07:56AM +0800, WenTao Liang wrote:
> qrtr_send_resume_tx() acquires a node reference via qrtr_node_lookup().
> If the subsequent qrtr_alloc_ctrl_packet() allocation fails, the
> function returns -ENOMEM without releasing the reference. This results
> in a reference count leak.
>
> Fix it by adding the missing qrtr_node_release(node) call on the error
> path.
>
> Cc: stable@vger.kernel.org
> Fixes: cb6530b99faf ("net: qrtr: Move resume-tx transmission to recvmsg")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
This appears to duplicate
3b09ff541145 ("net: qrtr: fix node refcount leak on ctrl packet alloc failure")
--
pw-bot: changes-requested
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-13 7:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-11 17:07 [PATCH] net: qrtr: fix refcount leak in qrtr_send_resume_tx() WenTao Liang
2026-06-13 7:51 ` Simon Horman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.