From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Mon, 14 Nov 2022 11:05:19 +0000 (+0000)
Subject: net/x25: Fix skb leak in x25_lapb_receive_frame()
X-Git-Tag: baikal/aarch64/sdk6.1~2651^2~9
X-Git-Url: https://git.baikalelectronics.ru/?a=commitdiff_plain;h=23115d992daaa735a5fb460db7779fb2f6e8bdd5;p=kernel.git

net/x25: Fix skb leak in x25_lapb_receive_frame()

x25_lapb_receive_frame() using skb_copy() to get a private copy of
skb, the new skb should be freed in the undersized/fragmented skb
error handling path. Otherwise there is a memory leak.

Fixes: c0cd20953e72 ("x25: Handle undersized/fragmented skbs")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/20221114110519.514538-1-weiyongjun@huaweicloud.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 5259ef8f5242f..748d8630ab58b 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -117,7 +117,7 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
 
 	if (!pskb_may_pull(skb, 1)) {
 		x25_neigh_put(nb);
-		return 0;
+		goto drop;
 	}
 
 	switch (skb->data[0]) {