On Fri, 2018-06-08 at 10:53 -0400, David Miller wrote: > From: Paolo Abeni <pab...@redhat.com> > Date: Wed, 6 Jun 2018 15:16:29 +0200 > > > @@ -1126,7 +1132,7 @@ static int kcm_recvmsg(struct socket *sock, struct > > msghdr *msg, > > > > lock_sock(sk); > > > > - skb = kcm_wait_data(sk, flags, timeo, &err); > > + skb = kcm_wait_data(sk, flags, peek, timeo, &err); > > if (!skb) > > goto out; > > > > Because kcm_wait_data() potentially unlinks now, you will have to kfree the > SKB in the error paths, for example if skb_copy_datagram_msg() fails. > > Otherwise we have an SKB leak.
Right. But now I fear the fix should be different: if we drop the skb on skb_copy_datagram_msg() error, that will cause a behavior change. I need to think more for a proper fix. Thank you for the feedback. Paolo
