netdev - [net] tipc: fix skb may be leaky in tipc_link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190211021828.6145-1-hoang.h.le@dektech.com.au>
Date:   Mon, 11 Feb 2019 09:18:28 +0700
From:   Hoang Le <hoang.h.le@...tech.com.au>
To:     tipc-discussion@...ts.sourceforge.net, jon.maloy@...csson.com,
        maloy@...jonn.com, ying.xue@...driver.com, netdev@...r.kernel.org
Subject: [net] tipc: fix skb may be leaky in tipc_link_input

When we free skb at tipc_data_input, we return a 'false' boolean.
Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,

<snip>
1303 int tipc_link_rcv:
...
1354    if (!tipc_data_input(l, skb, l->inputq))
1355        rc |= tipc_link_input(l, skb, l->inputq);
</snip>

Fix it by simple changing to a 'true' boolean when skb is being free-ed.
Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
condition.

Acked-by: Ying Xue <ying.xue@...driver.com>
Acked-by: Jon Maloy <maloy@...jonn.com>
Signed-off-by: Hoang Le <hoang.h.le@...tech.com.au>
---
 net/tipc/link.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index ac306d17f8ad..d31f83a9a2c5 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
 	default:
 		pr_warn("Dropping received illegal msg type\n");
 		kfree_skb(skb);
-		return false;
+		return true;
 	};
 }

-- 
2.17.1