From 1888b4cd84ba02fdf16a114d1c39f66f02e87d7e Mon Sep 17 00:00:00 2001 From: Hoang Le Date: Tue, 30 Apr 2019 08:49:07 +0000 Subject: [PATCH] tipc: fix skb may be leaky in tipc_link_input mainline inclusion from mainline-5.0 commit 7384b538d3 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- When we free skb at tipc_data_input, we return a 'false' boolean. Then, skb passed to subcalling tipc_link_input in tipc_link_rcv, 1303 int tipc_link_rcv: ... 1354 if (!tipc_data_input(l, skb, l->inputq)) 1355 rc |= tipc_link_input(l, skb, l->inputq); Fix it by simple changing to a 'true' boolean when skb is being free-ed. Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above condition. Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Hoang Le Signed-off-by: David S. Miller Signed-off-by: Zhiqiang Liu Reviewed-by: Mao Wenan Signed-off-by: Yang Yingliang --- net/tipc/link.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/link.c b/net/tipc/link.c index 836727e363c4..016d9d2f8aef 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -1107,7 +1107,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb, default: pr_warn("Dropping received illegal msg type\n"); kfree_skb(skb); - return false; + return true; }; } -- GitLab