[PATCH 2/3] tun: free skb in early errors
From: <hidden>
Date: 2017-12-01 05:54:28
Subsystem:
networking drivers, the rest, tun/tap driver · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Willem de Bruijn, Jason Wang
Possibly related (same subject, not in this thread)
- 2017-12-01 · Re: [PATCH 2/3] tun: free skb in early errors · "Michael S. Tsirkin" <mst@redhat.com>
- 2017-12-01 · Re: [PATCH 2/3] tun: free skb in early errors · "Michael S. Tsirkin" <mst@redhat.com>
- 2017-12-01 · [PATCH 2/3] tun: free skb in early errors · <hidden>
- 2017-12-01 · Re: [PATCH 2/3] tun: free skb in early errors · Jason Wang <hidden>
From: Wei Xu <redacted>
tun_recvmsg() supports accepting skb by msg_control after
commit ac77cfd4258f ("tun: support receiving skb through msg_control"),
the skb if presented should be freed within the function, otherwise it
would be leaked.
Signed-off-by: Wei Xu <redacted>
Reported-by: Matthew Rosato <redacted>
---
drivers/net/tun.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 6a7bde9..5563430 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c@@ -2067,14 +2067,17 @@ static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len, { struct tun_file *tfile = container_of(sock, struct tun_file, socket); struct tun_struct *tun = tun_get(tfile); + struct sk_buff *skb = m->msg_control; int ret; - if (!tun) - return -EBADFD; + if (!tun) { + ret = -EBADFD; + goto out_free_skb; + } if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) { ret = -EINVAL; - goto out; + goto out_free_skb; } if (flags & MSG_ERRQUEUE) { ret = sock_recv_errqueue(sock->sk, m, total_len,
@@ -2087,6 +2090,11 @@ static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len, m->msg_flags |= MSG_TRUNC; ret = flags & MSG_TRUNC ? ret : total_len; } + goto out; + +out_free_skb: + if (skb) + kfree_skb(skb); out: tun_put(tun); return ret;
--
1.8.3.1