From: xiaoshoukui tipc_data_input() returns false when an extracted inner skb or reassembled fragment is not consumed (e.g. unhandled protocol user types). The bundle extraction loop and fragment reassembly path in tipc_link_input() both ignore this return value, leaving unconsumed skbs unreachable and leaking SLUB memory. Fix this by freeing unconsumed skbs with kfree_skb_reason() and setting the drop reason to SKB_DROP_REASON_UNHANDLED_PROTO. Fixes: c637c1035534 ("tipc: resolve race problem at unicast message reception") Signed-off-by: xiaoshoukui --- net/tipc/link.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/net/tipc/link.c b/net/tipc/link.c index 49dfc098d89b..3278a559347b 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -1306,15 +1306,18 @@ static int tipc_link_input(struct tipc_link *l, struct sk_buff *skb, skb_queue_head_init(&tmpq); l->stats.recv_bundles++; l->stats.recv_bundled += msg_msgcnt(hdr); - while (tipc_msg_extract(skb, &iskb, &pos)) - tipc_data_input(l, iskb, &tmpq); + while (tipc_msg_extract(skb, &iskb, &pos)) { + if (!tipc_data_input(l, iskb, &tmpq)) + kfree_skb_reason(iskb, SKB_DROP_REASON_UNHANDLED_PROTO); + } tipc_skb_queue_splice_tail(&tmpq, inputq); return 0; } else if (usr == MSG_FRAGMENTER) { l->stats.recv_fragments++; if (tipc_buf_append(reasm_skb, &skb)) { l->stats.recv_fragmented++; - tipc_data_input(l, skb, inputq); + if (!tipc_data_input(l, skb, inputq)) + kfree_skb_reason(skb, SKB_DROP_REASON_UNHANDLED_PROTO); } else if (!*reasm_skb && !link_is_bc_rcvlink(l)) { pr_warn_ratelimited("Unable to build fragment list\n"); return tipc_link_fsm_evt(l, LINK_FAILURE_EVT); -- 2.34.1