Commit d46a3d0d07ba539aea5b0e1ad30e568f0cb03576
Committed by
Linus Torvalds
1 parent
5211e6e6c6
Exists in
master
and in
4 other branches
[PATCH] taskstats: fix sk_buff leak
'return genlmsg_cancel()' in taskstats_user_cmd/taskstats_exit_send potentially leaks a skb. Unless we pass 'rep_skb' to the netlink layer we own sk_buff. This means we should always do kfree_skb() on failure. [ Thomas acked and pointed out missing return value in original version ] Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Acked-by: Thomas Graf <tgraf@suug.ch> Cc: Andrew Morton <akpm@osdl.org> Cc: Shailabh Nagar <nagar@watson.ibm.com> Cc: Balbir Singh <balbir@in.ibm.com> Cc: Jay Lan <jlan@sgi.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Showing 1 changed file with 1 additions and 2 deletions Side-by-side Diff
kernel/taskstats.c
... | ... | @@ -411,7 +411,7 @@ |
411 | 411 | return send_reply(rep_skb, info->snd_pid); |
412 | 412 | |
413 | 413 | nla_put_failure: |
414 | - return genlmsg_cancel(rep_skb, reply); | |
414 | + rc = genlmsg_cancel(rep_skb, reply); | |
415 | 415 | err: |
416 | 416 | nlmsg_free(rep_skb); |
417 | 417 | return rc; |
... | ... | @@ -507,7 +507,6 @@ |
507 | 507 | |
508 | 508 | nla_put_failure: |
509 | 509 | genlmsg_cancel(rep_skb, reply); |
510 | - goto ret; | |
511 | 510 | err_skb: |
512 | 511 | nlmsg_free(rep_skb); |
513 | 512 | ret: |