[B.A.T.M.A.N.] [PATCH] batman-adv: Consume dropped packets with kfree_skb

[B.A.T.M.A.N.] [PATCH] batman-adv: Consume dropped packets with kfree_skb

[Sven Eckelmann]

The dropped skbs were previously free'd using kfree_skb in
batadv_batman_skb_recv with kfree_skb. This has to be done again directly
in the functions which also consume the skb on success.

Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: 83fef820ecdb ("batman-adv: Consume skb in receive handlers")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/bat_iv_ogm.c | 5 ++++-
 net/batman-adv/bat_v_elp.c  | 7 +++++--
 net/batman-adv/bat_v_ogm.c  | 5 ++++-
 net/batman-adv/routing.c    | 2 +-
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 36a1b3d..f00f666 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1851,7 +1851,10 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
 	ret = NET_RX_SUCCESS;
 
 free_skb:
-	consume_skb(skb);
+	if (ret == NET_RX_SUCCESS)
+		consume_skb(skb);
+	else
+		kfree_skb(skb);
 
 	return ret;
 }
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 6376240..f2fb2f0 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -498,7 +498,7 @@ int batadv_v_elp_packet_recv(struct sk_buff *skb,
 	struct batadv_hard_iface *primary_if;
 	struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header(skb);
 	bool res;
-	int ret;
+	int ret = NET_RX_DROP;
 
 	res = batadv_check_management_packet(skb, if_incoming, BATADV_ELP_HLEN);
 	if (!res)
@@ -531,7 +531,10 @@ int batadv_v_elp_packet_recv(struct sk_buff *skb,
 	batadv_hardif_put(primary_if);
 
 free_skb:
-	consume_skb(skb);
+	if (ret == NET_RX_SUCCESS)
+		consume_skb(skb);
+	else
+		kfree_skb(skb);
 
 	return ret;
 }
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index ef3a88d..38b9aab 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -844,7 +844,10 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
 	ret = NET_RX_SUCCESS;
 
 free_skb:
-	consume_skb(skb);
+	if (ret == NET_RX_SUCCESS)
+		consume_skb(skb);
+	else
+		kfree_skb(skb);
 
 	return ret;
 }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 7d9ae4b..6713bdf 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1066,7 +1066,7 @@ int batadv_recv_unicast_tvlv(struct sk_buff *skb,
 	}
 
 free_skb:
-	consume_skb(skb);
+	kfree_skb(skb);
 
 	return ret;
 }
-- 
2.10.2

Re: [B.A.T.M.A.N.] [PATCH] batman-adv: Consume dropped packets with kfree_skb

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 834 bytes --]

On Dienstag, 8. November 2016 18:59:05 CET Sven Eckelmann wrote:
> The dropped skbs were previously free'd using kfree_skb in
> batadv_batman_skb_recv with kfree_skb. This has to be done again directly
> in the functions which also consume the skb on success.
> 
> Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
> Fixes: 83fef820ecdb ("batman-adv: Consume skb in receive handlers")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
>  net/batman-adv/bat_iv_ogm.c | 5 ++++-
>  net/batman-adv/bat_v_elp.c  | 7 +++++--
>  net/batman-adv/bat_v_ogm.c  | 5 ++++-
>  net/batman-adv/routing.c    | 2 +-
>  4 files changed, 14 insertions(+), 5 deletions(-)


Applied in 7c21738fdfbdb50996e518cbf6bb4b30d8c04519 [1]

Kind regards,
	Sven

[1] https://git.open-mesh.org/batman-adv.git/commit/7c21738fdfbdb50996e518cbf6bb4b30d8c04519

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 801 bytes --]