Messages in this thread Patch in this message | | | From | Richard Weinberger <> | Subject | [PATCH] w1: Fix refcount leak in netlink connector | Date | Sun, 9 Mar 2014 00:08:48 +0100 |
| |
If userspace sends a w1 message of length 0 we leak the refcount.
Signed-off-by: Richard Weinberger <richard@nod.at> --- drivers/w1/w1_netlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c index 40788c9..7131777 100644 --- a/drivers/w1/w1_netlink.c +++ b/drivers/w1/w1_netlink.c @@ -355,7 +355,7 @@ static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) err = 0; if (!mlen) - goto out_cont; + goto out_dec; mutex_lock(&dev->mutex); @@ -384,10 +384,11 @@ static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp) mlen -= cmd->len + sizeof(struct w1_netlink_cmd); } out_up: + mutex_unlock(&dev->mutex); +out_dec: atomic_dec(&dev->refcnt); if (sl) atomic_dec(&sl->refcnt); - mutex_unlock(&dev->mutex); out_cont: if (!cmd || err) w1_netlink_send_error(msg, m, cmd, err); -- 1.8.4.2
| |