Patch "tap: free skb if flags error" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

tap: free skb if flags error

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tap-free-skb-if-flags-error.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Wei Xu <[email protected]>
Date: Fri, 1 Dec 2017 05:10:38 -0500
Subject: tap: free skb if flags error

From: Wei Xu <[email protected]>

[ Upstream commit 61d78537843e676e7f56ac6db333db0c0529b892 ]

tap_recvmsg() supports accepting skb by msg_control after commit 3b4ba04acca8 ("tap: support receiving skb from msg_control"), the skb if presented should be freed within the function, otherwise it would be leaked.

---
 drivers/net/tap.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

@@ -829,8 +829,11 @@ static ssize_t tap_do_read(struct tap_qu
 	DEFINE_WAIT(wait);
 	ssize_t ret = 0;
 
-	if (!iov_iter_count(to))
+	if (!iov_iter_count(to)) {
+		if (skb)
+			kfree_skb(skb);
 		return 0;
+	}
 
 	if (skb)
 		goto put;

@@ -1154,11 +1157,14 @@ static int tap_recvmsg(struct socket *so
 		       size_t total_len, int flags)
 {
 	struct tap_queue *q = container_of(sock, struct tap_queue, sock);
+	struct sk_buff *skb = m->msg_control;
 	int ret;
-	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
+	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) {
+		if (skb)
+			kfree_skb(skb);
 		return -EINVAL;
-	ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT,
-			  m->msg_control);
+	}
+	ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, skb);
 	if (ret > total_len) {
 		m->msg_flags |= MSG_TRUNC;
 		ret = flags & MSG_TRUNC ? ret : total_len;

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/tun-free-skb-in-early-errors.patch
queue-4.14/vhost-fix-skb-leak-in-handle_rx.patch
queue-4.14/tap-free-skb-if-flags-error.patch