Commit e00a5c33 authored by Cong Wang's avatar Cong Wang Committed by Daniel Borkmann
Browse files

udp: Fix a memory leak in udp_read_sock() 



sk_psock_verdict_recv() clones the skb and uses the clone
afterward, so udp_read_sock() should free the skb after using
it, regardless of error or not.

This fixes a real kmemleak.

Fixes: d7f57118 ("udp: Implement ->read_sock() for sockmap")
Signed-off-by: default avatarCong Wang <cong.wang@bytedance.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20210615021342.7416-4-xiyou.wangcong@gmail.com
parent a7e65fe7

net/ipv4/udp.c

+2 −0
Original line number Diff line number Diff line
@@ -1798,11 +1798,13 @@ int udp_read_sock(struct sock *sk, read_descriptor_t *desc, 
		if (used <= 0) {

			if (!copied)

				copied = used;

			kfree_skb(skb);

			break;

		} else if (used <= skb->len) {

			copied += used;

		}



		kfree_skb(skb);

		if (!desc->count)

			break;

	}