net/x25: Fix skb leak in x25_lapb_receive_frame()

[ Upstream commit 2929cceb2fcf0ded7182562e4888afafece82cce ]

x25_lapb_receive_frame() using skb_copy() to get a private copy of
skb, the new skb should be freed in the undersized/fragmented skb
error handling path. Otherwise there is a memory leak.

Fixes: cb101ed2c3c7 ("x25: Handle undersized/fragmented skbs")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/20221114110519.514538-1-weiyongjun@huaweicloud.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit c8baf1fc248b2e88642f094fea9509a9bf98c5bb)
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 5259ef8f5242f347ab0c2464db1c8f527c840691..748d8630ab58b9ed7937ccbf5e59483aecae1fa2 100644 (file)
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -117,7 +117,7 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
 
        if (!pskb_may_pull(skb, 1)) {
                x25_neigh_put(nb);
-               return 0;
+               goto drop;
        }
 
        switch (skb->data[0]) {