diff options
| author |   Sabrina Dubroca <sd@queasysnail.net> | 2025-04-09 15:59:56 +0200 |
|---|---|---|
| committer |   Steffen Klassert <steffen.klassert@secunet.com> | 2025-04-14 11:58:50 +0200 |
| commit | 63c1f19a3be3169e51a5812d22a6d0c879414076 (patch) | |
| tree | 066e3caa06dad8a706f7a1e4652710422f68fcde | |
| parent | ipv6: add exception routes to GC list in rt6_insert_exception (diff) | |
| download | linux-rng-63c1f19a3be3169e51a5812d22a6d0c879414076.tar.xz linux-rng-63c1f19a3be3169e51a5812d22a6d0c879414076.zip | |
espintcp: fix skb leaks
A few error paths are missing a kfree_skb.
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to '')
| -rw-r--r-- | net/ipv4/esp4.c | 4 | ||||
| -rw-r--r-- | net/ipv6/esp6.c | 4 | ||||
| -rw-r--r-- | net/xfrm/espintcp.c | 4 |
3 files changed, 9 insertions, 3 deletions
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c index 0e4076866c0a..876df672c0bf 100644 --- a/net/ipv4/esp4.c +++ b/net/ipv4/esp4.c @@ -199,8 +199,10 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb) sk = esp_find_tcp_sk(x); err = PTR_ERR_OR_ZERO(sk); - if (err) + if (err) { + kfree_skb(skb); goto out; + } bh_lock_sock(sk); if (sock_owned_by_user(sk)) diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index 9e73944e3b53..574989b82179 100644 --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c @@ -216,8 +216,10 @@ static int esp_output_tcp_finish(struct xfrm_state *x, struct sk_buff *skb) sk = esp6_find_tcp_sk(x); err = PTR_ERR_OR_ZERO(sk); - if (err) + if (err) { + kfree_skb(skb); goto out; + } bh_lock_sock(sk); if (sock_owned_by_user(sk)) diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c index fe82e2d07300..fc7a603b04f1 100644 --- a/net/xfrm/espintcp.c +++ b/net/xfrm/espintcp.c @@ -171,8 +171,10 @@ int espintcp_queue_out(struct sock *sk, struct sk_buff *skb) struct espintcp_ctx *ctx = espintcp_getctx(sk); if (skb_queue_len(&ctx->out_queue) >= - READ_ONCE(net_hotdata.max_backlog)) + READ_ONCE(net_hotdata.max_backlog)) { + kfree_skb(skb); return -ENOBUFS; + } __skb_queue_tail(&ctx->out_queue, skb); |