[PATCH] nfc: llcp: Fix socket reference leak in nfc_llcp_recv_ui()

[Wentao Liang <vulab@iscas.ac.cn>]

In nfc_llcp_recv_ui(), nfc_llcp_sock_get() is called to find the bound
socket. If the socket type is not SOCK_DGRAM, the function returns
directly without releasing the socket reference via nfc_llcp_sock_put(),
resulting in a reference count leak.

Add nfc_llcp_sock_put() when the socket type is not SOCK_DGRAM.

Fixes: 968272bf0087 ("NFC: Handle LLCP UI frames")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/nfc/llcp_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index db5bc6a878dd..5813c80ca593 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -888,8 +888,12 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
 
 	/* We're looking for a bound socket, not a client one */
 	llcp_sock = nfc_llcp_sock_get(local, dsap, LLCP_SAP_SDP);
-	if (llcp_sock == NULL || llcp_sock->sk.sk_type != SOCK_DGRAM)
+	if (!llcp_sock)
 		return;
+	if (llcp_sock->sk.sk_type != SOCK_DGRAM) {
+		nfc_llcp_sock_put(llcp_sock);
+		return;
+	}
 
 	/* There is no sequence with UI frames */
 	skb_pull(skb, LLCP_HEADER_SIZE);
-- 
2.34.1