[PATCH net] tipc: fix memory leaks in bundle and fragment paths

[xiaoshoukui@gmail.com]

From: xiaoshoukui <xiaoshoukui@gmail.com>

tipc_data_input() returns false when an extracted inner skb or
reassembled fragment is not consumed (e.g. unhandled protocol user
types).

The bundle extraction loop and fragment reassembly path in
tipc_link_input() both ignore this return value, leaving unconsumed
skbs unreachable and leaking SLUB memory.

Fix this by freeing unconsumed skbs with kfree_skb_reason() and
setting the drop reason to SKB_DROP_REASON_UNHANDLED_PROTO.

Fixes: c637c1035534 ("tipc: resolve race problem at unicast message reception")
Signed-off-by: xiaoshoukui <xiaoshoukui@gmail.com>
---
 net/tipc/link.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 49dfc098d89b..3278a559347b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1306,15 +1306,18 @@ static int tipc_link_input(struct tipc_link *l, struct sk_buff *skb,
 		skb_queue_head_init(&tmpq);
 		l->stats.recv_bundles++;
 		l->stats.recv_bundled += msg_msgcnt(hdr);
-		while (tipc_msg_extract(skb, &iskb, &pos))
-			tipc_data_input(l, iskb, &tmpq);
+		while (tipc_msg_extract(skb, &iskb, &pos)) {
+			if (!tipc_data_input(l, iskb, &tmpq))
+				kfree_skb_reason(iskb, SKB_DROP_REASON_UNHANDLED_PROTO);
+		}
 		tipc_skb_queue_splice_tail(&tmpq, inputq);
 		return 0;
 	} else if (usr == MSG_FRAGMENTER) {
 		l->stats.recv_fragments++;
 		if (tipc_buf_append(reasm_skb, &skb)) {
 			l->stats.recv_fragmented++;
-			tipc_data_input(l, skb, inputq);
+			if (!tipc_data_input(l, skb, inputq))
+				kfree_skb_reason(skb, SKB_DROP_REASON_UNHANDLED_PROTO);
 		} else if (!*reasm_skb && !link_is_bc_rcvlink(l)) {
 			pr_warn_ratelimited("Unable to build fragment list\n");
 			return tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
-- 
2.34.1