diff options
| author |   Cong Wang <cong.wang@bytedance.com> | 2021-06-14 19:13:39 -0700 |
|---|---|---|
| committer |   Daniel Borkmann <daniel@iogearbox.net> | 2021-06-21 16:48:33 +0200 |
| commit | 0cf6672b23c8aa9d9274798dd63cbf6ede77ef90 (patch) | |
| tree | 77b94072cb23f15461b0fb65adf635768e3c164c /net/core/skmsg.c | |
| parent | skmsg: Clear skb redirect pointer before dropping it (diff) | |
| download | linux-dev-0cf6672b23c8aa9d9274798dd63cbf6ede77ef90.tar.xz linux-dev-0cf6672b23c8aa9d9274798dd63cbf6ede77ef90.zip | |
skmsg: Fix a memory leak in sk_psock_verdict_apply()
If the dest psock does not set SK_PSOCK_TX_ENABLED,
the skb can't be queued anywhere so must be dropped.
This one is found during code review.
Fixes: 799aa7f98d53 ("skmsg: Avoid lock_sock() in sk_psock_backlog()")
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20210615021342.7416-6-xiyou.wangcong@gmail.com
Diffstat (limited to 'net/core/skmsg.c')
| -rw-r--r-- | net/core/skmsg.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 4334720e2a04..5464477e2d3d 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -924,8 +924,13 @@ static void sk_psock_verdict_apply(struct sk_psock *psock, if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { skb_queue_tail(&psock->ingress_skb, skb); schedule_work(&psock->work); + err = 0; } spin_unlock_bh(&psock->ingress_lock); + if (err < 0) { + skb_bpf_redirect_clear(skb); + goto out_free; + } } break; case __SK_REDIRECT: |