net: fix secpath kmemleak
Mike Kazantsev found 3.5 kernels and beyond were leaking memory, and tracked the faulty commit to a1c7fff7 ("net: netdev_alloc_skb() use build_skb()") While this commit seems fine, it uncovered a bug introduced in commit bad43ca8 ("net: introduce skb_try_coalesce()), in function kfree_skb_partial()"): If head is stolen, we free the sk_buff, without removing references on secpath (skb->sp). So IPsec + IP defrag/reassembly (using skb coalescing), or TCP coalescing could leak secpath objects. Fix this bug by calling skb_release_head_state(skb) to properly release all possible references to linked objects. Reported-by:Mike Kazantsev <mk.fraggod@gmail.com> Signed-off-by:
Eric Dumazet <edumazet@google.com> Bisected-by:
Mike Kazantsev <mk.fraggod@gmail.com> Tested-by:
Mike Kazantsev <mk.fraggod@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
parent
8a6e29d6
Please register or sign in to comment