Re: [PATCH net] net: mctp: take ownership of skb in mctp_local_output

[Simon Horman <horms@kernel.org>]

On Thu, Feb 15, 2024 at 03:53:09PM +0800, Jeremy Kerr wrote:
> Currently, mctp_local_output only takes ownership of skb on success, and
> we may leak an skb if mctp_local_output fails in specific states; the
> skb ownership isn't transferred until the actual output routing occurs.
> 
> Instead, make mctp_local_output free the skb on all error paths up to
> the route action, so it always consumes the passed skb.
> 
> Fixes: 833ef3b91de6 ("mctp: Populate socket implementation")
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>

...

> diff --git a/net/mctp/route.c b/net/mctp/route.c
> index 7a47a58aa54b..a64788bc40a8 100644
> --- a/net/mctp/route.c
> +++ b/net/mctp/route.c
> @@ -888,7 +888,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
>  		dev = dev_get_by_index_rcu(sock_net(sk), cb->ifindex);
>  		if (!dev) {
>  			rcu_read_unlock();
> -			return rc;
> +			goto out_free;
>  		}
>  		rt->dev = __mctp_dev_get(dev);
>  		rcu_read_unlock();
> @@ -903,7 +903,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
>  		rt->mtu = 0;
>  
>  	} else {
> -		return -EINVAL;
> +		goto out_free;

Hi Jeremy,

Previously this path returned -EINVAL. Now it will return rc.
But by my reading rc is set to -ENODEV here.
Should that be addressed?

>  	}
>  
>  	spin_lock_irqsave(&rt->dev->addrs_lock, flags);
> @@ -966,12 +966,17 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
>  		rc = mctp_do_fragment_route(rt, skb, mtu, tag);
>  	}
>  
> +	/* route output functions consume the skb, even on error */
> +	skb = NULL;
> +
>  out_release:
>  	if (!ext_rt)
>  		mctp_route_release(rt);
>  
>  	mctp_dev_put(tmp_rt.dev);
>  
> +out_free:
> +	kfree_skb(skb);
>  	return rc;
>  }
>  
> -- 
> 2.39.2
> 
>