Make rpl_input() free the skb before returning when skb_cow_head()
fails. Use a "drop" label and goto instructions.

Note: if you think it should be a fix and target "net" instead, let me
know.

Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
---
 net/ipv6/rpl_iptunnel.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
index 2c83b7586422..db3c19a42e1c 100644
--- a/net/ipv6/rpl_iptunnel.c
+++ b/net/ipv6/rpl_iptunnel.c
@@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb)
 	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);
 
 	err = rpl_do_srh(skb, rlwt);
-	if (unlikely(err)) {
-		kfree_skb(skb);
-		return err;
-	}
+	if (unlikely(err))
+		goto drop;
 
 	local_bh_disable();
 	dst = dst_cache_get(&rlwt->cache);
@@ -286,9 +284,13 @@ static int rpl_input(struct sk_buff *skb)
 
 	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
 	if (unlikely(err))
-		return err;
+		goto drop;
 
 	return dst_input(skb);
+
+drop:
+	kfree_skb(skb);
+	return err;
 }
 
 static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
-- 
2.34.1

From: Justin Iurman <justin.iurman@uliege.be>
Date: Tue, 10 Sep 2024 12:00:32 +0200
> Make rpl_input() free the skb before returning when skb_cow_head()
> fails. Use a "drop" label and goto instructions.
> 
> Note: if you think it should be a fix and target "net" instead, let me
> know.

Please do so.

For the future submission, this kind of note and changelog between
each revision can be placed after '---' below so that it will disappear
during merge.

> 
> Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
> ---
>  net/ipv6/rpl_iptunnel.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
> index 2c83b7586422..db3c19a42e1c 100644
> --- a/net/ipv6/rpl_iptunnel.c
> +++ b/net/ipv6/rpl_iptunnel.c
> @@ -263,10 +263,8 @@ static int rpl_input(struct sk_buff *skb)
>  	rlwt = rpl_lwt_lwtunnel(orig_dst->lwtstate);
>  
>  	err = rpl_do_srh(skb, rlwt);
> -	if (unlikely(err)) {
> -		kfree_skb(skb);
> -		return err;
> -	}
> +	if (unlikely(err))
> +		goto drop;
>  
>  	local_bh_disable();
>  	dst = dst_cache_get(&rlwt->cache);
> @@ -286,9 +284,13 @@ static int rpl_input(struct sk_buff *skb)
>  
>  	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
>  	if (unlikely(err))
> -		return err;
> +		goto drop;
>  
>  	return dst_input(skb);
> +
> +drop:
> +	kfree_skb(skb);
> +	return err;
>  }
>  
>  static int nla_put_rpl_srh(struct sk_buff *skb, int attrtype,
> --

On Tue, 10 Sep 2024 13:40:10 -0700 Kuniyuki Iwashima wrote:
> > Note: if you think it should be a fix and target "net" instead, let me
> > know.  
> 
> Please do so.

Just to be clear - with a Fixes tag present.