]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
authorXin Xiong <xiongx18@fudan.edu.cn>
Wed, 29 Jul 2020 13:06:59 +0000 (21:06 +0800)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Fri, 4 Sep 2020 19:28:45 +0000 (16:28 -0300)
commit2dee93b6745dc55a00682fb5a87ac8d1a0e1b770
treed27ce0bc0320375d0a42602d9571c4ffa22f3b5a
parentb0d5179c928b3d01d8666d94a6d3d45e525d3cc3
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent

BugLink: https://bugs.launchpad.net/bugs/1891387
[ Upstream commit 51875dad43b44241b46a569493f1e4bfa0386d86 ]

atmtcp_remove_persistent() invokes atm_dev_lookup(), which returns a
reference of atm_dev with increased refcount or NULL if fails.

The refcount leaks issues occur in two error handling paths. If
dev_data->persist is zero or PRIV(dev)->vcc isn't NULL, the function
returns 0 without decreasing the refcount kept by a local variable,
resulting in refcount leaks.

Fix the issue by adding atm_dev_put() before returning 0 both when
dev_data->persist is zero or PRIV(dev)->vcc isn't NULL.

Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Ian May <ian.may@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>
drivers/atm/atmtcp.c