From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 356CB3009EE for ; Mon, 4 May 2026 07:40:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777880415; cv=none; b=oFYPJQzSXzvxTt2f3qyRpxFioOGfsy+FVczdTz1KfWneic2L6SFyoWy13j8aL5GiXjETTtAExYiPDin6dg7h+PsEjr4vXDyZsSMBFYp+u/WrGFubeid6G33V+IxB3FTgjfjdmXCFXm3h+/W2NyFYtsSYil8/aQNYq1+RuoNrscU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777880415; c=relaxed/simple; bh=k8+uM6E3lWrEBQNbcejM3rucTlMtFpdSUtrixBYlLOU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UZYOQte5Im+NXUVo9qLuFD8+FXN+r/r/IyEENSDfSe55yQ6lKk5PV5JhvEDnBcjiLs8vewazUqBZo9JIMOP4HZce98aIDsGzJLoYAw/Vlds9yWSHrlCK+2zYXbvDrLrzTw5PGi2H6oMKxh7y9PJgod8QySacL1ORhtN5PJJcc6E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eurP0aRn; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eurP0aRn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9CE81C2BCC4; Mon, 4 May 2026 07:40:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777880414; bh=k8+uM6E3lWrEBQNbcejM3rucTlMtFpdSUtrixBYlLOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eurP0aRnwXvi8JmAPUPk4KAh7ISk+R5HVgR0KXZ0eVqRu6WN09echO91XogxJKZIy PEBdVlSEZ47zyMr+e4Zs4tH1d7mgV4sdLvKM6VDgonTU4K7nkIIclG9SJoqDnvDWJV zahRXtTuYB2Jj2FlwQXEeoQ3EyiCQHz2aqpHNKlCAt3VJXZzuWUHUdQ+QcGbtyTbLU rl7kLJJMw1XgWTuis4a9ZDpkMzgMS2/DThGv+vIO1mc9bABNQpx/Wvhw6ZE1TTE3wB rtcU4Qx6JQ59Gc8orHdQvsq+VVqpyQlp3IuhJR3vEp2ym0m2xvCcFGPHueYHAm2gH7 nfj87Vbs/UjEw== From: Sasha Levin To: stable@vger.kernel.org Cc: Manivannan Sadhasivam , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.18.y 1/2] net: qrtr: ns: Free the node during ctrl_cmd_bye() Date: Mon, 4 May 2026 03:40:07 -0400 Message-ID: <20260504074008.1850682-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026050151-blooper-pang-c22e@gregkh> References: <2026050151-blooper-pang-c22e@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Manivannan Sadhasivam [ Upstream commit 68efba36446a7774ea5b971257ade049272a07ac ] A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak. Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye(). Cc: stable@vger.kernel.org Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20260409-qrtr-fix-v3-3-00a8a5ff2b51@oss.qualcomm.com Signed-off-by: Jakub Kicinski Stable-dep-of: 27d5e84e810b ("net: qrtr: ns: Limit the total number of nodes") Signed-off-by: Sasha Levin --- net/qrtr/ns.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c index 3de9350cbf307..e1f27464279cf 100644 --- a/net/qrtr/ns.c +++ b/net/qrtr/ns.c @@ -341,7 +341,7 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) struct qrtr_node *node; unsigned long index; struct kvec iv; - int ret; + int ret = 0; iv.iov_base = &pkt; iv.iov_len = sizeof(pkt); @@ -356,8 +356,10 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) /* Advertise the removal of this client to all local servers */ local_node = node_get(qrtr_ns.local_node); - if (!local_node) - return 0; + if (!local_node) { + ret = 0; + goto delete_node; + } memset(&pkt, 0, sizeof(pkt)); pkt.cmd = cpu_to_le32(QRTR_TYPE_BYE); @@ -374,10 +376,18 @@ static int ctrl_cmd_bye(struct sockaddr_qrtr *from) ret = kernel_sendmsg(qrtr_ns.sock, &msg, &iv, 1, sizeof(pkt)); if (ret < 0 && ret != -ENODEV) { pr_err("failed to send bye cmd\n"); - return ret; + goto delete_node; } } - return 0; + + /* Ignore -ENODEV */ + ret = 0; + +delete_node: + xa_erase(&nodes, from->sq_node); + kfree(node); + + return ret; } static int ctrl_cmd_del_client(struct sockaddr_qrtr *from, -- 2.53.0