[PATCH net] tipc: fix memory leaks in bundle and fragment paths
From: <hidden>
Date: 2026-09-16 06:14:03
Subsystem:
networking [general], the rest, tipc network layer · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Jon Maloy, Tung Quang Nguyen
From: xiaoshoukui <redacted>
tipc_data_input() returns false when an extracted inner skb or
reassembled fragment is not consumed (e.g. unhandled protocol user
types).
The bundle extraction loop and fragment reassembly path in
tipc_link_input() both ignore this return value, leaving unconsumed
skbs unreachable and leaking SLUB memory.
Fix this by freeing unconsumed skbs with kfree_skb_reason() and
setting the drop reason to SKB_DROP_REASON_UNHANDLED_PROTO.
Fixes: c637c1035534 ("tipc: resolve race problem at unicast message reception")
Signed-off-by: xiaoshoukui <redacted>
---
net/tipc/link.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 49dfc098d89b..3278a559347b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c@@ -1306,15 +1306,18 @@ static int tipc_link_input(struct tipc_link *l, struct sk_buff *skb, skb_queue_head_init(&tmpq); l->stats.recv_bundles++; l->stats.recv_bundled += msg_msgcnt(hdr); - while (tipc_msg_extract(skb, &iskb, &pos)) - tipc_data_input(l, iskb, &tmpq); + while (tipc_msg_extract(skb, &iskb, &pos)) { + if (!tipc_data_input(l, iskb, &tmpq)) + kfree_skb_reason(iskb, SKB_DROP_REASON_UNHANDLED_PROTO); + } tipc_skb_queue_splice_tail(&tmpq, inputq); return 0; } else if (usr == MSG_FRAGMENTER) { l->stats.recv_fragments++; if (tipc_buf_append(reasm_skb, &skb)) { l->stats.recv_fragmented++; - tipc_data_input(l, skb, inputq); + if (!tipc_data_input(l, skb, inputq)) + kfree_skb_reason(skb, SKB_DROP_REASON_UNHANDLED_PROTO); } else if (!*reasm_skb && !link_is_bc_rcvlink(l)) { pr_warn_ratelimited("Unable to build fragment list\n"); return tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
--
2.34.1