From 522e4aece2e96cacbb8a6ae1eec0d4c0dd6f4fed Mon Sep 17 00:00:00 2001 From: Sven Eckelmann Date: Tue, 13 Oct 2026 11:23:34 +0000 Subject: [PATCH] batman-adv: fix skb leak when hard_iface is being released batadv_batman_skb_recv() owns the skb it is given. When the hard_iface refcount already dropped to zero, the function jumped to err_out, which only returned NET_RX_DROP and skipped the kfree_skb() under err_free. To avoid a leak, free the skb before returning in this case. Cc: stable@vger.kernel.org Fixes: 4fe56e60ac1b ("batman-adv: Check hard_iface refcnt when receiving skb") Signed-off-by: Sven Eckelmann --- net/batman-adv/main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 6c54a8d4be3e..ced76942f33c 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -484,8 +484,10 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev, * shut down otherwise the packet may trigger de-reference errors * further down in the receive path. */ - if (!kref_get_unless_zero(&hard_iface->refcount)) - goto err_out; + if (!kref_get_unless_zero(&hard_iface->refcount)) { + kfree_skb(skb); + return NET_RX_DROP; + } skb = skb_share_check(skb, GFP_ATOMIC); @@ -541,7 +543,6 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev, kfree_skb(skb); err_put: batadv_hardif_put(hard_iface); -err_out: return NET_RX_DROP; }