| Message ID | 20210514012303.6177-1-hoang.h.le@dektech.com.au |
|---|---|
| State | New |
| Headers | show |
| Series | [net] Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" | expand |
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Fri, 14 May 2021 08:23:03 +0700 you wrote: > This reverts commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046. > Above fix is not correct and caused memory leak issue. > > Fixes: 6bf24dc0cc0c ("net:tipc: Fix a double free in tipc_sk_mcast_rcv") > Acked-by: Jon Maloy <jmaloy@redhat.com> > Acked-by: Tung Nguyen <tung.q.nguyen@dektech.com.au> > Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au> > > [...] Here is the summary with links: - [net] Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" https://git.kernel.org/netdev/net/c/75016891357a You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 58935cd0d068..53af72824c9c 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1262,7 +1262,10 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq, spin_lock_bh(&inputq->lock); if (skb_peek(arrvq) == skb) { skb_queue_splice_tail_init(&tmpq, inputq); - __skb_dequeue(arrvq); + /* Decrease the skb's refcnt as increasing in the + * function tipc_skb_peek + */ + kfree_skb(__skb_dequeue(arrvq)); } spin_unlock_bh(&inputq->lock); __skb_queue_purge(&tmpq);
This reverts commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046. Above fix is not correct and caused memory leak issue. Fixes: 6bf24dc0cc0c ("net:tipc: Fix a double free in tipc_sk_mcast_rcv") Acked-by: Jon Maloy <jmaloy@redhat.com> Acked-by: Tung Nguyen <tung.q.nguyen@dektech.com.au> Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au> --- net/tipc/socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)