diff options
| author | Taehee Yoo <ap420073@gmail.com> | 2019-07-02 17:24:04 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-07-08 03:42:48 +0200 |
| commit | e30155fd23c9c141cbe7d99b786e10a83a328837 (patch) | |
| tree | 10e7d1a627220bfe1bc037ab14956cc83a363d48 /drivers/net | |
| parent | gtp: fix use-after-free in gtp_newlink() (diff) | |
| download | linux-e30155fd23c9c141cbe7d99b786e10a83a328837.tar.xz linux-e30155fd23c9c141cbe7d99b786e10a83a328837.zip | |
gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable()
If an invalid role is sent from user space, gtp_encap_enable() will fail.
Then, it should call gtp_encap_disable_sock() but current code doesn't.
It makes memory leak.
Fixes: 91ed81f9abc7 ("gtp: support SGSN-side tunnels")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/gtp.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index b3ccac54e204..ecfe26215935 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -857,8 +857,13 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[]) if (data[IFLA_GTP_ROLE]) { role = nla_get_u32(data[IFLA_GTP_ROLE]); - if (role > GTP_ROLE_SGSN) + if (role > GTP_ROLE_SGSN) { + if (sk0) + gtp_encap_disable_sock(sk0); + if (sk1u) + gtp_encap_disable_sock(sk1u); return -EINVAL; + } } gtp->sk0 = sk0; |