diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-10-13 11:23:34 +0000 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-10-30 10:11:25 +0100 |
| commit | 522e4aece2e96cacbb8a6ae1eec0d4c0dd6f4fed (patch) | |
| tree | e5ea83229fcd4dc5ce09b684808101b9ef13a96c | |
| parent | 4eb19a389d74f06901b4cd6f24b996b2e84eaefc (diff) | |
batman-adv: fix skb leak when hard_iface is being released
batadv_batman_skb_recv() owns the skb it is given. When the hard_iface
refcount already dropped to zero, the function jumped to err_out, which
only returned NET_RX_DROP and skipped the kfree_skb() under err_free.
To avoid a leak, free the skb before returning in this case.
Cc: stable@vger.kernel.org
Fixes: 4fe56e60ac1b ("batman-adv: Check hard_iface refcnt when receiving skb")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
| -rw-r--r-- | net/batman-adv/main.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 6c54a8d4be3e..ced76942f33c 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -484,8 +484,10 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev, * shut down otherwise the packet may trigger de-reference errors * further down in the receive path. */ - if (!kref_get_unless_zero(&hard_iface->refcount)) - goto err_out; + if (!kref_get_unless_zero(&hard_iface->refcount)) { + kfree_skb(skb); + return NET_RX_DROP; + } skb = skb_share_check(skb, GFP_ATOMIC); @@ -541,7 +543,6 @@ err_free: kfree_skb(skb); err_put: batadv_hardif_put(hard_iface); -err_out: return NET_RX_DROP; } |