[PATCH 5.15 179/206] espintcp: fix skb leaks

Greg Kroah-Hartman
2026-02-04T15:01:25Z

From: Sabrina Dubroca <sd@queasysnail.net>

[ Upstream commit 63c1f19a3be3169e51a5812d22a6d0c879414076 ]

A few error paths are missing a kfree_skb.

Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
[ Minor context change fixed. ]
Signed-off-by: Bin Lan <lanbincn@139.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/esp4.c | 4 +++-
net/ipv6/esp6.c | 4 +++-
net/xfrm/espintcp.c | 4 +++-
3 files changed, 9 insertions(+), 3 deletions(-)

--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -196,8 +196,10 @@ static int esp_output_tcp_finish(struct

sk = esp_find_tcp_sk(x);
err = PTR_ERR_OR_ZERO(sk);
- if (err)
+ if (err) {
+ kfree_skb(skb);
goto out;
+ }

bh_lock_sock(sk);
if (sock_owned_by_user(sk))
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -214,8 +214,10 @@ static int esp_output_tcp_finish(struct

sk = esp6_find_tcp_sk(x);
err = PTR_ERR_OR_ZERO(sk);
- if (err)
+ if (err) {
+ kfree_skb(skb);
goto out;
+ }

bh_lock_sock(sk);
if (sock_owned_by_user(sk))
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -170,8 +170,10 @@ int espintcp_queue_out(struct sock *sk,
{
struct espintcp_ctx *ctx = espintcp_getctx(sk);

- if (skb_queue_len(&ctx->out_queue) >= READ_ONCE(netdev_max_backlog))
+ if (skb_queue_len(&ctx->out_queue) >= READ_ONCE(netdev_max_backlog)) {
+ kfree_skb(skb);
return -ENOBUFS;
+ }

__skb_queue_tail(&ctx->out_queue, skb);