| From bb3d0b6110304c454ac20170b3258d7b1a6baadd Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 11 Feb 2019 09:18:28 +0700 |
| Subject: tipc: fix skb may be leaky in tipc_link_input |
| |
| From: Hoang Le <hoang.h.le@dektech.com.au> |
| |
| [ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ] |
| |
| When we free skb at tipc_data_input, we return a 'false' boolean. |
| Then, skb passed to subcalling tipc_link_input in tipc_link_rcv, |
| |
| <snip> |
| 1303 int tipc_link_rcv: |
| ... |
| 1354 if (!tipc_data_input(l, skb, l->inputq)) |
| 1355 rc |= tipc_link_input(l, skb, l->inputq); |
| </snip> |
| |
| Fix it by simple changing to a 'true' boolean when skb is being free-ed. |
| Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above |
| condition. |
| |
| Acked-by: Ying Xue <ying.xue@windriver.com> |
| Acked-by: Jon Maloy <maloy@donjonn.com> |
| Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/tipc/link.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/net/tipc/link.c b/net/tipc/link.c |
| index 4e8647aef01c1..c7406c1fdc14b 100644 |
| --- a/net/tipc/link.c |
| +++ b/net/tipc/link.c |
| @@ -1063,7 +1063,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb, |
| default: |
| pr_warn("Dropping received illegal msg type\n"); |
| kfree_skb(skb); |
| - return false; |
| + return true; |
| }; |
| } |
| |
| -- |
| 2.20.1 |
| |