Skip to content

Commit 8a02fb7

Browse files
prati0100kuba-moo
authored andcommitted
net: fix skb leak in __skb_tstamp_tx()
Commit 50749f2 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocopy skbs. But it ended up adding a leak of its own. When skb_orphan_frags_rx() fails, the function just returns, leaking the skb it just cloned. Free it before returning. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 50749f2 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") Signed-off-by: Pratyush Yadav <[email protected]> Reviewed-by: Kuniyuki Iwashima <[email protected]> Reviewed-by: Willem de Bruijn <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent d6c36cb commit 8a02fb7

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

net/core/skbuff.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5224,8 +5224,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
52245224
} else {
52255225
skb = skb_clone(orig_skb, GFP_ATOMIC);
52265226

5227-
if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
5227+
if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) {
5228+
kfree_skb(skb);
52285229
return;
5230+
}
52295231
}
52305232
if (!skb)
52315233
return;

0 commit comments

Comments
 (0)