diff options
| author | Jeremy Kerr <jk@codeconstruct.com.au> | 2024-02-20 16:10:53 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-02-22 19:21:11 -0800 |
| commit | 3773d65ae5154ed7df404b050fd7387a36ab5ef3 (patch) | |
| tree | e88b1897f90f38182da186945678e20f322c12a3 /include/net/mctp.h | |
| parent | e872469c38b9283ef9de5e43d49286f9533ad848 (diff) | |
net: mctp: take ownership of skb in mctp_local_output
Currently, mctp_local_output only takes ownership of skb on success, and
we may leak an skb if mctp_local_output fails in specific states; the
skb ownership isn't transferred until the actual output routing occurs.
Instead, make mctp_local_output free the skb on all error paths up to
the route action, so it always consumes the passed skb.
Fixes: 833ef3b91de6 ("mctp: Populate socket implementation")
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240220081053.1439104-1-jk@codeconstruct.com.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/net/mctp.h')
| -rw-r--r-- | include/net/mctp.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/net/mctp.h b/include/net/mctp.h index da86e106c91d..2bff5f47ce82 100644 --- a/include/net/mctp.h +++ b/include/net/mctp.h @@ -249,6 +249,7 @@ struct mctp_route { struct mctp_route *mctp_route_lookup(struct net *net, unsigned int dnet, mctp_eid_t daddr); +/* always takes ownership of skb */ int mctp_local_output(struct sock *sk, struct mctp_route *rt, struct sk_buff *skb, mctp_eid_t daddr, u8 req_tag); |