Commit 3773d65a authored by Jeremy Kerr's avatar Jeremy Kerr Committed by Jakub Kicinski
Browse files

net: mctp: take ownership of skb in mctp_local_output 



Currently, mctp_local_output only takes ownership of skb on success, and
we may leak an skb if mctp_local_output fails in specific states; the
skb ownership isn't transferred until the actual output routing occurs.

Instead, make mctp_local_output free the skb on all error paths up to
the route action, so it always consumes the passed skb.

Fixes: 833ef3b9 ("mctp: Populate socket implementation")
Signed-off-by: default avatarJeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240220081053.1439104-1-jk@codeconstruct.com.au


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent e872469c

include/net/mctp.h

+1 −0
Original line number Diff line number Diff line
@@ -249,6 +249,7 @@ struct mctp_route { 
struct mctp_route *mctp_route_lookup(struct net *net, unsigned int dnet,

				     mctp_eid_t daddr);



/* always takes ownership of skb */

int mctp_local_output(struct sock *sk, struct mctp_route *rt,

		      struct sk_buff *skb, mctp_eid_t daddr, u8 req_tag);

net/mctp/route.c

+8 −2
Original line number Diff line number Diff line
@@ -888,7 +888,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
		dev = dev_get_by_index_rcu(sock_net(sk), cb->ifindex);

		if (!dev) {

			rcu_read_unlock();

			return rc;

			goto out_free;

		}

		rt->dev = __mctp_dev_get(dev);

		rcu_read_unlock();
@@ -903,7 +903,8 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
		rt->mtu = 0;



	} else {

		return -EINVAL;

		rc = -EINVAL;

		goto out_free;

	}



	spin_lock_irqsave(&rt->dev->addrs_lock, flags);
@@ -966,12 +967,17 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, 
		rc = mctp_do_fragment_route(rt, skb, mtu, tag);

	}



	/* route output functions consume the skb, even on error */

	skb = NULL;



out_release:

	if (!ext_rt)

		mctp_route_release(rt);



	mctp_dev_put(tmp_rt.dev);



out_free:

	kfree_skb(skb);

	return rc;

}