linux-stable/net/mctp
Matt Johnston 0b93aed284 mctp: Avoid leak of mctp_sk_key
mctp_key_alloc() returns a key already referenced.

The mctp_route_input() path receives a packet for a bind socket and
allocates a key. It passes the key to mctp_key_add() which takes a
refcount and adds the key to lists. mctp_route_input() should then
release its own refcount when setting the key pointer to NULL.

In the mctp_alloc_local_tag() path (for mctp_local_output()) we
similarly need to unref the key before returning (mctp_reserve_tag()
takes a refcount and adds the key to lists).

Fixes: 73c618456d ("mctp: locking, lifetime and validity changes for sk_keys")
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Reviewed-by: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-10-15 11:22:08 +01:00
..
test mctp: Add input reassembly tests 2021-10-03 14:35:41 +01:00
af_mctp.c mctp: Do inits as a subsys_initcall 2021-09-29 11:00:11 +01:00
device.c mctp: Warn if pointer is set for a wrong dev type 2021-09-29 11:00:12 +01:00
Kconfig mctp: Add initial test structure and fragmentation test 2021-10-03 14:35:41 +01:00
Makefile mctp: Add test utils 2021-10-03 14:35:41 +01:00
neigh.c mctp: Add refcounts to mctp_dev 2021-09-29 11:00:11 +01:00
route.c mctp: Avoid leak of mctp_sk_key 2021-10-15 11:22:08 +01:00