connection: fix memory leak wrt cancel_fd

We have to poll_freewait() in error pathes.

Signed-off-by: Daniel Mack <daniel@zonque.org>

diff --git a/connection.c b/connection.c
index c5136b7cd30966600d2904b842ba57f797cd74d1..1fcb177881b54fd8e10f19d84df1b49a42104ed2 100644 (file)
--- a/connection.c
+++ b/connection.c
@@ -649,9 +649,13 @@ static int kdbus_conn_wait_reply(struct kdbus_conn *conn_src,
                                         KDBUS_ITEM_CANCEL_FD);
        if (!IS_ERR(cancel_fd_item)) {
                cancel_fd = fget(cancel_fd_item->fds[0]);
-               if (IS_ERR(cancel_fd))
+               if (IS_ERR(cancel_fd)) {
+                       poll_freewait(&pwq);
                        return PTR_ERR(cancel_fd);
+               }
+
                if (!cancel_fd->f_op->poll) {
+                       poll_freewait(&pwq);
                        fput(cancel_fd);
                        return -EINVAL;
                }