The reference counting of ax25_dev potentially increase more
than once in ax25_addr_ax25dev(), which will cause memory leak.

In order to fix the above issue, only increase the reference
counting of ax25_dev once, when the res is not null.

Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
---
 net/ax25/ax25_dev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
index 07723095c60..7c2ea7309b0 100644
--- a/net/ax25/ax25_dev.c
+++ b/net/ax25/ax25_dev.c
@@ -37,8 +37,9 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
 	for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next)
 		if (ax25cmp(addr, (const ax25_address *)ax25_dev->dev->dev_addr) == 0) {
 			res = ax25_dev;
-			ax25_dev_hold(ax25_dev);
 		}
+	if (res)
+		ax25_dev_hold(res);
 	spin_unlock_bh(&ax25_dev_lock);
 
 	return res;
-- 
2.17.1

How do you think about to append parentheses to the function name
in the summary phrase?


> The reference counting of ax25_dev potentially increase more
> than once in ax25_addr_ax25dev(), which will cause memory leak.
>
> In order to fix the above issue, only increase the reference
> counting of ax25_dev once, when the res is not null.

Would you find the following change description a bit nicer?

   The reference counter of the object “ax25_dev” can be increased multiple times
   in ax25_addr_ax25dev(). This will cause a memory leak so far.

   Thus move a needed function call behind a for loop
   and increase the reference counter only when the local variable “res”
   is not a null pointer.


…
> +++ b/net/ax25/ax25_dev.c
> @@ -37,8 +37,9 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr)
…

Would you like to omit curly brackets in the affected function implementation?

Regards,
Markus

Yeah, it's true that we should delete the curly braces around the if
block.  Otherwise checkpatch.pl -f will complain.

The commit message is fine as-is.  Please stop nit-picking.

regards,
dan carpenter

> The commit message is fine as-is.  Please stop nit-picking.

I dare to point recurring improvement possibilities out.
I became curious if the change acceptance will ever grow accordingly.

Regards,
Markus