af_iucv: Free iucv path/socket in path_pending callback

Free iucv path after iucv_path_sever() calls in iucv_callback_connreq()
(path_pending() iucv callback).
If iucv_path_accept() fails, free path and free/kill newly created socket.

Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 0 deletions

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 6b5f193e5f48..eb8a2a0b6eb7 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1042,12 +1042,14 @@ static int iucv_callback_connreq(struct iucv_path *path,
         ASCEBC(user_data, sizeof(user_data));
         if (sk->sk_state != IUCV_LISTEN) {
                 err = iucv_path_sever(path, user_data);
+                iucv_path_free(path);
                 goto fail;
         }
 
         /* Check for backlog size */
         if (sk_acceptq_is_full(sk)) {
                 err = iucv_path_sever(path, user_data);
+                iucv_path_free(path);
                 goto fail;
         }
 
@@ -1055,6 +1057,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
         nsk = iucv_sock_alloc(NULL, SOCK_STREAM, GFP_ATOMIC);
         if (!nsk) {
                 err = iucv_path_sever(path, user_data);
+                iucv_path_free(path);
                 goto fail;
         }
 
@@ -1078,6 +1081,8 @@ static int iucv_callback_connreq(struct iucv_path *path,
         err = iucv_path_accept(path, &af_iucv_handler, nuser_data, nsk);
         if (err) {
                 err = iucv_path_sever(path, user_data);
+                iucv_path_free(path);
+                iucv_sock_kill(nsk);
                 goto fail;
         }