CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry()

In the Linux kernel, the following vulnerability has been resolved:

netrom: Fix a memory leak in nrheartbeatexpiry()

syzbot reported a memory leak in nrcreate() [0].

Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sockhold() to the nrheartbeatexpiry() function, where a) a socket has a SOCKDESTROY flag or b) a listening socket has a SOCKDEAD flag.

But in the case "a," when the SOCKDESTROY flag is set, the file descriptor has already been closed and the nrrelease() function has been called. So it makes no sense to hold the reference count because no one will call another nrdestroysocket() and put it as in the case "b."

nrconnect nrestablishdatalink nrstartheartbeat

nrrelease switch (nr->state) case NRSTATE3 nr->state = NRSTATE2 socksetflag(sk, SOCKDESTROY);

nrrxframe nrprocessrxframe switch (nr->state) case NRSTATE2 nrstate2machine() nrdisconnect() nrsk(sk)->state = NRSTATE0 socksetflag(sk, SOCKDEAD)

nrheartbeatexpiry switch (nr->state) case NRSTATE0 if (sockflag(sk, SOCKDESTROY) || (sk->skstate == TCPLISTEN && sockflag(sk, SOCKDEAD))) sockhold() // ( !!! ) nrdestroysocket()

To fix the memory leak, let's call sockhold() only for a listening socket.

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.

[0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16