6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bernard Pidoux nr_del_node() takes a reference on the node with its lookup. When the route it deletes is not the last one, it drops that reference before returning. When it is the last one, it only unlinks the node with nr_remove_node_locked(), which drops the list's reference, and returns still holding its own: the unlinked node is never freed. Seen with kmemleak on a live node after adding and then deleting a route to a dummy node with nrparms (SIOCADDRT then SIOCDELRT): the 96-byte nr_node allocated by nr_add_node(), callsign and mnemonic of the dummy node in its hex dump, is reported as unreferenced. Drop the lookup reference in both cases. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Bernard Pidoux (cherry picked from commit a4b96115783fdefae9599f9a84a39e24fb288d6b) Signed-off-by: Sasha Levin --- net/netrom/nr_route.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index 98ba317ada637..288c4a91ea9b7 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -388,8 +388,9 @@ static int nr_del_node(ax25_address *callsign, ax25_address *neighbour, struct n case 2: break; } - nr_node_put(nr_node); } + /* Drop the reference taken by __nr_node_get() */ + nr_node_put(nr_node); ret = 0; goto out; } -- 2.53.0