• David Fries's avatar
    w1: fix netlink refcnt leak on error path · 593ceb0c
    David Fries authored
    If the message type is W1_MASTER_CMD or W1_SLAVE_CMD, then a reference
    is taken when searching for the slave or master device.  If there
    isn't any following data m->len (mlen is a copy) is 0 and packing up
    the message for later execution is skipped leaving nothing to
    decrement the reference counts.
    
    Way back when, m->len was checked before the search that increments the
    reference count, but W1_LIST_MASTERS has no additional data, the check
    was moved in 9be62e0b causing this bug.
    
    This change reorders to put the check before the reference count is
    incremented avoiding the problem.
    Signed-off-by: default avatarDavid Fries <David@Fries.net>
    Acked-by: default avatarEvgeniy Polyakov <zbr@ioremap.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    593ceb0c
w1_netlink.c 14.1 KB