irda: Sock leak on error path in irda_create.

Bad type/protocol specified result in sk leak.

Fix is simple - release the sk if bad values are given,
but to make it possible just to call sk_free(), I move
some sk initialization a bit lower.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index ae54b20d047035116afcd7c31abf021ee898b83b..3eb5bcc75f99083eb971b93eddbb967d704ad81a 100644 (file)
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1093,11 +1093,6 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
 
        init_waitqueue_head(&self->query_wait);
 
-       /* Initialise networking socket struct */
-       sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
-       sk->sk_family = PF_IRDA;
-       sk->sk_protocol = protocol;
-
        switch (sock->type) {
        case SOCK_STREAM:
                sock->ops = &irda_stream_ops;
@@ -1124,13 +1119,20 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
                        self->max_sdu_size_rx = TTP_SAR_UNBOUND;
                        break;
                default:
+                       sk_free(sk);
                        return -ESOCKTNOSUPPORT;
                }
                break;
        default:
+               sk_free(sk);
                return -ESOCKTNOSUPPORT;
        }
 
+       /* Initialise networking socket struct */
+       sock_init_data(sock, sk);       /* Note : set sk->sk_refcnt to 1 */
+       sk->sk_family = PF_IRDA;
+       sk->sk_protocol = protocol;
+
        /* Register as a client with IrLMP */
        self->ckey = irlmp_register_client(0, NULL, NULL, NULL);
        self->mask.word = 0xffff;