Re: [tipc-discussion] [net] tipc: fix skb may be leaky in tipc_link_input

[Ying X. <yin...@wi...>]

On 1/30/19 2:45 PM, Hoang Le wrote:
> When we free skb at tipc_data_input, we return a 'false' boolean.
> Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,
> 
> <snip>
> 1303 int tipc_link_rcv:
> ...
> 1354    if (!tipc_data_input(l, skb, l->inputq))
> 1355        rc |= tipc_link_input(l, skb, l->inputq);
> </snip>
> 
> Fix it by simple changing to a 'true' boolean when skb is being free-ed.
> Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
> condition.
> 
> Signed-off-by: Hoang Le <hoa...@de...>

Acked-by: Ying Xue <yin...@wi...>

> ---
>  net/tipc/link.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/tipc/link.c b/net/tipc/link.c
> index ac306d17f8ad..d31f83a9a2c5 100644
> --- a/net/tipc/link.c
> +++ b/net/tipc/link.c
> @@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
>  	default:
>  		pr_warn("Dropping received illegal msg type\n");
>  		kfree_skb(skb);
> -		return false;
> +		return true;
>  	};
>  }
>  
>