mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-09 01:59:41 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/x25
History
Xiyu Yang d9ef1c5524 net/x25: Fix x25_neigh refcnt leak when receiving frame 
[ Upstream commit f35d12971b ]

x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a
reference of the specified x25_neigh object to "nb" with increased
refcnt.

When x25_lapb_receive_frame() returns, local variable "nb" becomes
invalid, so the refcount should be decreased to keep refcount balanced.

The reference counting issue happens in one path of
x25_lapb_receive_frame(). When pskb_may_pull() returns false, the
function forgets to decrease the refcnt increased by x25_get_neigh(),
causing a refcnt leak.

Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns
false.

Fixes: cb101ed2c3 ("x25: Handle undersized/fragmented skbs")
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-29 16:31:21 +02:00
..
af_x25.c net/x25: fix nonblocking connect 2020-01-29 16:43:24 +01:00
Kconfig x25: remove blank lines at EOF 2018-07-24 14:10:42 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sysctl_net_x25.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
x25_dev.c net/x25: Fix x25_neigh refcnt leak when receiving frame 2020-04-29 16:31:21 +02:00
x25_facilities.c net: x25: mark expected switch fall-throughs 2017-10-22 03:08:46 +01:00
x25_forward.c
x25_in.c net: x25: mark expected switch fall-throughs 2017-10-22 03:08:46 +01:00
x25_link.c treewide: setup_timer() -> timer_setup() 2017-11-21 15:57:07 -08:00
x25_out.c
x25_proc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
x25_route.c net, x25: convert x25_route.refcnt from atomic_t to refcount_t 2017-07-04 22:35:18 +01:00
x25_subr.c x25: remove blank lines at EOF 2018-07-24 14:10:42 -07:00
x25_timer.c treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts 2017-11-21 16:35:54 -08:00