[PATCH] net: qrtr: fix refcount leak in qrtr_send_resume_tx()

[WenTao Liang]

qrtr_send_resume_tx() acquires a node reference via qrtr_node_lookup().
If the subsequent qrtr_alloc_ctrl_packet() allocation fails, the
function returns -ENOMEM without releasing the reference. This results
in a reference count leak.

Fix it by adding the missing qrtr_node_release(node) call on the error
path.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: cb6530b99faf ("net: qrtr: Move resume-tx transmission to recvmsg")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 net/qrtr/af_qrtr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 7cec6a7859b0..c9f892427f7c 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -1009,8 +1009,10 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb)
 		return -EINVAL;
 
 	skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL);
-	if (!skb)
+	if (!skb) {
+		qrtr_node_release(node);
 		return -ENOMEM;
+	}
 
 	pkt->cmd = cpu_to_le32(QRTR_TYPE_RESUME_TX);
 	pkt->client.node = cpu_to_le32(cb->dst_node);
-- 
2.50.1 (Apple Git-155)