aboutsummaryrefslogtreecommitdiffstats
path: root/net/tipc/link.c
diff options
context:
space:
mode:
authorHoang Le <hoang.h.le@dektech.com.au>2019-02-11 09:18:28 +0700
committerDavid S. Miller <davem@davemloft.net>2019-02-11 18:35:52 -0800
commit7384b538d3aed2ed49d3575483d17aeee790fb06 (patch)
tree1d3c7deb0a11aa4beb9817b2452df97f0a1d4bf1 /net/tipc/link.c
parentnet/x25: do not hold the cpu too long in x25_new_lci() (diff)
downloadlinux-dev-7384b538d3aed2ed49d3575483d17aeee790fb06.tar.xz
linux-dev-7384b538d3aed2ed49d3575483d17aeee790fb06.zip
tipc: fix skb may be leaky in tipc_link_input
When we free skb at tipc_data_input, we return a 'false' boolean. Then, skb passed to subcalling tipc_link_input in tipc_link_rcv, <snip> 1303 int tipc_link_rcv: ... 1354 if (!tipc_data_input(l, skb, l->inputq)) 1355 rc |= tipc_link_input(l, skb, l->inputq); </snip> Fix it by simple changing to a 'true' boolean when skb is being free-ed. Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above condition. Acked-by: Ying Xue <ying.xue@windriver.com> Acked-by: Jon Maloy <maloy@donjonn.com> Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc/link.c')
-rw-r--r--net/tipc/link.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 2792a3cae682..7c70034b1073 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
default:
pr_warn("Dropping received illegal msg type\n");
kfree_skb(skb);
- return false;
+ return true;
};
}