From: Hangyu Hua <hbh25y@gmail.com> stable inclusion from stable-v4.19.253 commit ef488669b2652bde5b6ee5a409a5b048a2a50db4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP398 CVE: CVE-2022-49620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c ] Free sk in case tipc_sk_insert() fails. Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Wang Liang <wangliang74@huawei.com> --- net/tipc/socket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 6a1e7ff667ad..f8a555def98f 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -453,6 +453,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, sock_init_data(sock, sk); tipc_set_sk_state(sk, TIPC_OPEN); if (tipc_sk_insert(tsk)) { + sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } -- 2.34.1