l2tpd_lapd: fix memleak when sending data to unix sockets
The msg was allocated a second time by msgb_copy() even when lapd_ehdlc_to_lapd handles the further allocation itself. Meaning every data packet leaked.
This commit is contained in:
parent
0400931ac2
commit
aa97a1d4b1
|
@ -193,7 +193,7 @@ int lapd_ehdlc_to_lapd(struct l2tpd_instance *l2i, struct l2tpd_session *l2s, st
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
send_msg = l2tp_msgb_alloc();
|
send_msg = msgb_alloc_headroom(1600, 100, "ehdlc_to_lapd");
|
||||||
memcpy(msgb_data(send_msg), msgb_data(msg), length);
|
memcpy(msgb_data(send_msg), msgb_data(msg), length);
|
||||||
msgb_pull(msg, length);
|
msgb_pull(msg, length);
|
||||||
msgb_put(send_msg, length);
|
msgb_put(send_msg, length);
|
||||||
|
|
|
@ -954,9 +954,7 @@ static int l2tp_rcvmsg_data(struct msgb *msg)
|
||||||
}
|
}
|
||||||
|
|
||||||
/* ignore crc on rx */
|
/* ignore crc on rx */
|
||||||
struct msgb *send_msg = msgb_copy(msg, "data_to_unix");
|
return lapd_ehdlc_to_lapd(l2i, l2s, msg);
|
||||||
|
|
||||||
return lapd_ehdlc_to_lapd(l2i, l2s, send_msg);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
int l2tp_rcvmsg(struct msgb *msg)
|
int l2tp_rcvmsg(struct msgb *msg)
|
||||||
|
|
Loading…
Reference in New Issue