| From foo@baz Sun Dec 31 11:13:15 CET 2017 |
| From: Willem de Bruijn <willemb@google.com> |
| Date: Wed, 13 Dec 2017 14:41:06 -0500 |
| Subject: sock: free skb in skb_complete_tx_timestamp on error |
| |
| From: Willem de Bruijn <willemb@google.com> |
| |
| |
| [ Upstream commit 35b99dffc3f710cafceee6c8c6ac6a98eb2cb4bf ] |
| |
| skb_complete_tx_timestamp must ingest the skb it is passed. Call |
| kfree_skb if the skb cannot be enqueued. |
| |
| Fixes: b245be1f4db1 ("net-timestamp: no-payload only sysctl") |
| Fixes: 9ac25fc06375 ("net: fix socket refcounting in skb_complete_tx_timestamp()") |
| Reported-by: Richard Cochran <richardcochran@gmail.com> |
| Signed-off-by: Willem de Bruijn <willemb@google.com> |
| Reviewed-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/core/skbuff.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| --- a/net/core/skbuff.c |
| +++ b/net/core/skbuff.c |
| @@ -3823,7 +3823,7 @@ void skb_complete_tx_timestamp(struct sk |
| struct sock *sk = skb->sk; |
| |
| if (!skb_may_tx_timestamp(sk, false)) |
| - return; |
| + goto err; |
| |
| /* Take a reference to prevent skb_orphan() from freeing the socket, |
| * but only if the socket refcount is not zero. |
| @@ -3832,7 +3832,11 @@ void skb_complete_tx_timestamp(struct sk |
| *skb_hwtstamps(skb) = *hwtstamps; |
| __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); |
| sock_put(sk); |
| + return; |
| } |
| + |
| +err: |
| + kfree_skb(skb); |
| } |
| EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); |
| |
