llc: fix sk_buff refcounting in llc_conn_state_process()
authorEric Biggers <ebiggers@google.com>
Sun, 6 Oct 2019 21:24:27 +0000 (14:24 -0700)
committerJakub Kicinski <jakub.kicinski@netronome.com>
Tue, 8 Oct 2019 20:23:05 +0000 (13:23 -0700)
commit36453c852816f19947ca482a595dffdd2efa4965
treef0204d988d31cc5bc60a8e66c208a971dc48917a
parentfc8d5db10cbe1338a52ebc74e7feab9276721774
llc: fix sk_buff refcounting in llc_conn_state_process()

If llc_conn_state_process() sees that llc_conn_service() put the skb on
a list, it will drop one fewer references to it.  This is wrong because
the current behavior is that llc_conn_service() never consumes a
reference to the skb.

The code also makes the number of skb references being dropped
conditional on which of ind_prim and cfm_prim are nonzero, yet neither
of these affects how many references are *acquired*.  So there is extra
code that tries to fix this up by sometimes taking another reference.

Remove the unnecessary/broken refcounting logic and instead just add an
skb_get() before the only two places where an extra reference is
actually consumed.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
net/llc/llc_conn.c