Commit 63c1f19a authored Apr 09, 2025 by Sabrina Dubroca Committed by Steffen Klassert Apr 14, 2025

espintcp: fix skb leaks



A few error paths are missing a kfree_skb.

Fixes: e27cca96 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent cfe82469

net/ipv4/esp4.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -199,8 +199,10 @@ static int esp_output_tcp_finish(struct xfrm_state x, struct sk_buff skb)

		sk = esp_find_tcp_sk(x);
		err = PTR_ERR_OR_ZERO(sk);
		if (err)
		if (err) {
		kfree_skb(skb);
		goto out;
		}

		bh_lock_sock(sk);
		if (sock_owned_by_user(sk))

net/ipv6/esp6.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -216,8 +216,10 @@ static int esp_output_tcp_finish(struct xfrm_state x, struct sk_buff skb)

		sk = esp6_find_tcp_sk(x);
		err = PTR_ERR_OR_ZERO(sk);
		if (err)
		if (err) {
		kfree_skb(skb);
		goto out;
		}

		bh_lock_sock(sk);
		if (sock_owned_by_user(sk))

net/xfrm/espintcp.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -171,8 +171,10 @@ int espintcp_queue_out(struct sock sk, struct sk_buff skb)
		struct espintcp_ctx *ctx = espintcp_getctx(sk);

		if (skb_queue_len(&ctx->out_queue) >=
		READ_ONCE(net_hotdata.max_backlog))
		READ_ONCE(net_hotdata.max_backlog)) {
		kfree_skb(skb);
		return -ENOBUFS;
		}

		__skb_queue_tail(&ctx->out_queue, skb);