qrtr_send_resume_tx() acquires a node reference via qrtr_node_lookup(). If the subsequent qrtr_alloc_ctrl_packet() allocation fails, the function returns -ENOMEM without releasing the reference. This results in a reference count leak. Fix it by adding the missing qrtr_node_release(node) call on the error path. Cc: stable@vger.kernel.org Fixes: cb6530b99faf ("net: qrtr: Move resume-tx transmission to recvmsg") Signed-off-by: WenTao Liang --- net/qrtr/af_qrtr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c index 7cec6a7859b0..c9f892427f7c 100644 --- a/net/qrtr/af_qrtr.c +++ b/net/qrtr/af_qrtr.c @@ -1009,8 +1009,10 @@ static int qrtr_send_resume_tx(struct qrtr_cb *cb) return -EINVAL; skb = qrtr_alloc_ctrl_packet(&pkt, GFP_KERNEL); - if (!skb) + if (!skb) { + qrtr_node_release(node); return -ENOMEM; + } pkt->cmd = cpu_to_le32(QRTR_TYPE_RESUME_TX); pkt->client.node = cpu_to_le32(cb->dst_node); -- 2.50.1 (Apple Git-155)