Merge branch 'rmnet-Fix-leaks-in-failure-scenarios'

Subash Abhinov Kasiviswanathan says:

====================
net: qualcomm: rmnet: Fix leaks in failure scenarios

Patch 1 fixes a leak in transmit path where a skb cannot be
transmitted due to insufficient headroom to stamp the map header.
Patch 2 fixes a leak in rmnet_newlink() failure because the
rmnet endpoint was never freed
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2017-12-05 18:03:55 -05:00
commit a5266440d5
2 changed files with 7 additions and 2 deletions

View File

@ -195,6 +195,7 @@ static int rmnet_newlink(struct net *src_net, struct net_device *dev,
err1: err1:
rmnet_unregister_real_device(real_dev, port); rmnet_unregister_real_device(real_dev, port);
err0: err0:
kfree(ep);
return err; return err;
} }

View File

@ -126,12 +126,12 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
if (skb_headroom(skb) < required_headroom) { if (skb_headroom(skb) < required_headroom) {
if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL)) if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL))
return RMNET_MAP_CONSUMED; goto fail;
} }
map_header = rmnet_map_add_map_header(skb, additional_header_len, 0); map_header = rmnet_map_add_map_header(skb, additional_header_len, 0);
if (!map_header) if (!map_header)
return RMNET_MAP_CONSUMED; goto fail;
if (port->egress_data_format & RMNET_EGRESS_FORMAT_MUXING) { if (port->egress_data_format & RMNET_EGRESS_FORMAT_MUXING) {
if (mux_id == 0xff) if (mux_id == 0xff)
@ -143,6 +143,10 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
skb->protocol = htons(ETH_P_MAP); skb->protocol = htons(ETH_P_MAP);
return RMNET_MAP_SUCCESS; return RMNET_MAP_SUCCESS;
fail:
kfree_skb(skb);
return RMNET_MAP_CONSUMED;
} }
static void static void