diff options
author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2018-07-04 11:22:42 -0400 |
---|---|---|
committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2018-07-04 11:22:42 -0400 |
commit | 26003835520c52935fa8cb32756383d043927478 (patch) | |
tree | 46da231de9aed0549433e3f942dfea8a7ae45ebf | |
parent | b5c56d866cdde359fa8af0c7fa62e403a4f59689 (diff) | |
download | longterm-queue-4.12-26003835520c52935fa8cb32756383d043927478.tar.gz |
tun: drop post 4.12 patch
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r-- | queue/series | 1 | ||||
-rw-r--r-- | queue/tun-free-skb-in-early-errors.patch | 83 |
2 files changed, 0 insertions, 84 deletions
diff --git a/queue/series b/queue/series index 520d57e..ef65ce2 100644 --- a/queue/series +++ b/queue/series @@ -121,6 +121,5 @@ tcp-dccp-block-bh-before-arming-time_wait-timer.patch tcp-remove-buggy-call-to-tcp_v6_restore_cb.patch tipc-call-tipc_rcv-only-if-bearer-is-up-in-tipc_udp_.patch tipc-fix-memory-leak-in-tipc_accept_from_sock.patch -tun-free-skb-in-early-errors.patch usbnet-fix-alignment-for-frames-with-no-ethernet-hea.patch vhost-fix-skb-leak-in-handle_rx.patch diff --git a/queue/tun-free-skb-in-early-errors.patch b/queue/tun-free-skb-in-early-errors.patch deleted file mode 100644 index ec38dd1..0000000 --- a/queue/tun-free-skb-in-early-errors.patch +++ /dev/null @@ -1,83 +0,0 @@ -From c33ee15b3820a03cf8229ba9415084197b827f8c Mon Sep 17 00:00:00 2001 -From: Wei Xu <wexu@redhat.com> -Date: Fri, 1 Dec 2017 05:10:37 -0500 -Subject: [PATCH] tun: free skb in early errors - -commit c33ee15b3820a03cf8229ba9415084197b827f8c upstream. - -tun_recvmsg() supports accepting skb by msg_control after -commit ac77cfd4258f ("tun: support receiving skb through msg_control"), -the skb if presented should be freed no matter how far it can go -along, otherwise it would be leaked. - -This patch fixes several missed cases. - -Signed-off-by: Wei Xu <wexu@redhat.com> -Reported-by: Matthew Rosato <mjrosato@linux.vnet.ibm.com> -Acked-by: Michael S. Tsirkin <mst@redhat.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 95749006d687..4f4a842a1c9c 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1952,8 +1952,11 @@ static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile, - - tun_debug(KERN_INFO, tun, "tun_do_read\n"); - -- if (!iov_iter_count(to)) -+ if (!iov_iter_count(to)) { -+ if (skb) -+ kfree_skb(skb); - return 0; -+ } - - if (!skb) { - /* Read frames from ring */ -@@ -2069,22 +2072,24 @@ static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len, - { - struct tun_file *tfile = container_of(sock, struct tun_file, socket); - struct tun_struct *tun = tun_get(tfile); -+ struct sk_buff *skb = m->msg_control; - int ret; - -- if (!tun) -- return -EBADFD; -+ if (!tun) { -+ ret = -EBADFD; -+ goto out_free_skb; -+ } - - if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) { - ret = -EINVAL; -- goto out; -+ goto out_put_tun; - } - if (flags & MSG_ERRQUEUE) { - ret = sock_recv_errqueue(sock->sk, m, total_len, - SOL_PACKET, TUN_TX_TIMESTAMP); - goto out; - } -- ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, -- m->msg_control); -+ ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, skb); - if (ret > (ssize_t)total_len) { - m->msg_flags |= MSG_TRUNC; - ret = flags & MSG_TRUNC ? ret : total_len; -@@ -2092,6 +2097,13 @@ static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len, - out: - tun_put(tun); - return ret; -+ -+out_put_tun: -+ tun_put(tun); -+out_free_skb: -+ if (skb) -+ kfree_skb(skb); -+ return ret; - } - - static int tun_peek_len(struct socket *sock) --- -2.15.0 - |