diff options
| author |   Eric Biggers <ebiggers@google.com> | 2019-10-06 14:24:27 -0700 |
|---|---|---|
| committer |   Jakub Kicinski <jakub.kicinski@netronome.com> | 2019-10-08 13:23:05 -0700 |
| commit | 36453c852816f19947ca482a595dffdd2efa4965 (patch) | |
| tree | f0204d988d31cc5bc60a8e66c208a971dc48917a /CREDITS | |
| parent | llc: fix another potential sk_buff leak in llc_ui_sendmsg() (diff) | |
| download | linux-dev-36453c852816f19947ca482a595dffdd2efa4965.tar.xz linux-dev-36453c852816f19947ca482a595dffdd2efa4965.zip | |
llc: fix sk_buff refcounting in llc_conn_state_process()
If llc_conn_state_process() sees that llc_conn_service() put the skb on
a list, it will drop one fewer references to it. This is wrong because
the current behavior is that llc_conn_service() never consumes a
reference to the skb.
The code also makes the number of skb references being dropped
conditional on which of ind_prim and cfm_prim are nonzero, yet neither
of these affects how many references are *acquired*. So there is extra
code that tries to fix this up by sometimes taking another reference.
Remove the unnecessary/broken refcounting logic and instead just add an
skb_get() before the only two places where an extra reference is
actually consumed.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Diffstat (limited to 'CREDITS')
0 files changed, 0 insertions, 0 deletions