| Message ID | 90710748c29a1521efac4f75ea01b3b7e61414cf.1714485818.git.lucien.xin@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 97bf6f81b29a8efaf5d0983251a7450e5794370d |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] tipc: fix a possible memleak in tipc_buf_append | expand |
On Tue, Apr 30, 2024 at 10:03:38AM -0400, Xin Long wrote: > __skb_linearize() doesn't free the skb when it fails, so move > '*buf = NULL' after __skb_linearize(), so that the skb can be > freed on the err path. > > Fixes: b7df21cf1b79 ("tipc: skb_linearize the head skb when reassembling msgs") > Reported-by: Paolo Abeni <pabeni@redhat.com> > Signed-off-by: Xin Long <lucien.xin@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org>
>Subject: [PATCH net] tipc: fix a possible memleak in tipc_buf_append > >__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the >err path. > >Fixes: b7df21cf1b79 ("tipc: skb_linearize the head skb when reassembling msgs") >Reported-by: Paolo Abeni <pabeni@redhat.com> >Signed-off-by: Xin Long <lucien.xin@gmail.com> >--- > net/tipc/msg.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 5c9fd4791c4b..c52ab423082c 100644 >--- a/net/tipc/msg.c >+++ b/net/tipc/msg.c >@@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) > if (fragid == FIRST_FRAGMENT) { > if (unlikely(head)) > goto err; >- *buf = NULL; > if (skb_has_frag_list(frag) && __skb_linearize(frag)) > goto err; >+ *buf = NULL; > frag = skb_unshare(frag, GFP_ATOMIC); > if (unlikely(!frag)) > goto err; >-- >2.43.0 Reviewed-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 30 Apr 2024 10:03:38 -0400 you wrote: > __skb_linearize() doesn't free the skb when it fails, so move > '*buf = NULL' after __skb_linearize(), so that the skb can be > freed on the err path. > > Fixes: b7df21cf1b79 ("tipc: skb_linearize the head skb when reassembling msgs") > Reported-by: Paolo Abeni <pabeni@redhat.com> > Signed-off-by: Xin Long <lucien.xin@gmail.com> > > [...] Here is the summary with links: - [net] tipc: fix a possible memleak in tipc_buf_append https://git.kernel.org/netdev/net/c/97bf6f81b29a You are awesome, thank you!
diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 5c9fd4791c4b..c52ab423082c 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - *buf = NULL; if (skb_has_frag_list(frag) && __skb_linearize(frag)) goto err; + *buf = NULL; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err;
__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path. Fixes: b7df21cf1b79 ("tipc: skb_linearize the head skb when reassembling msgs") Reported-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> --- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)