tcp_bpf: properly release resources on error paths

In the blamed commit below, I completely forgot to release the acquired
resources before erroring out in the TCP BPF code, as reported by Dan.

Address the issues by replacing the bogus return with a jump to the
relevant cleanup code.

Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/8f99194c698bcef12666f0a9a999c58f8b1cb52c.1697557782.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index ba2e921881248780c67a9e92a2c04783994f6ca3..53b0d62fd2c2dbfcdd3b65bdc9f2b839a6f51687 100644 (file)
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -307,8 +307,10 @@ msg_bytes_ready:
                }
 
                data = tcp_msg_wait_data(sk, psock, timeo);
-               if (data < 0)
-                       return data;
+               if (data < 0) {
+                       copied = data;
+                       goto unlock;
+               }
                if (data && !sk_psock_queue_empty(psock))
                        goto msg_bytes_ready;
                copied = -EAGAIN;
@@ -319,6 +321,8 @@ out:
        tcp_rcv_space_adjust(sk);
        if (copied > 0)
                __tcp_cleanup_rbuf(sk, copied);
+
+unlock:
        release_sock(sk);
        sk_psock_put(sk, psock);
        return copied;
@@ -353,8 +357,10 @@ msg_bytes_ready:
 
                timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
                data = tcp_msg_wait_data(sk, psock, timeo);
-               if (data < 0)
-                       return data;
+               if (data < 0) {
+                       ret = data;
+                       goto unlock;
+               }
                if (data) {
                        if (!sk_psock_queue_empty(psock))
                                goto msg_bytes_ready;
@@ -365,6 +371,8 @@ msg_bytes_ready:
                copied = -EAGAIN;
        }
        ret = copied;
+
+unlock:
        release_sock(sk);
        sk_psock_put(sk, psock);
        return ret;