On Thu, Jan 26, 2023 at 12:16 PM Jeremy Kerr <jk@codeconstruct.com.au> wrote:
>
> We may have pending skbs in the receive queue when the sk is being
> destroyed; add a destructor to purge the queue.
>
> MCTP doesn't use the error queue, so only the receive_queue is purged.
>
> Fixes: 833ef3b91de6 ("mctp: Populate socket implementation")
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
> ---
>  net/mctp/af_mctp.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c
> index 45bbe3e54cc2..3150f3f0c872 100644
> --- a/net/mctp/af_mctp.c
> +++ b/net/mctp/af_mctp.c
> @@ -587,6 +587,11 @@ static void mctp_sk_unhash(struct sock *sk)
>         del_timer_sync(&msk->key_expiry);
>  }
>
> +static void mctp_sk_destruct(struct sock *sk)
> +{
> +       skb_queue_purge(&sk->sk_receive_queue);
> +}
> +
>  static struct proto mctp_proto = {
>         .name           = "MCTP",
>         .owner          = THIS_MODULE,
> @@ -623,6 +628,7 @@ static int mctp_pf_create(struct net *net, struct socket *sock,
>                 return -ENOMEM;
>
>         sock_init_data(sock, sk);
> +       sk->sk_destruct = mctp_sk_destruct;
>
>         rc = 0;
>         if (sk->sk_prot->init)
> --
> 2.35.1
>
Looks good to me.
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>