After commit dce4551cb2ad ("udp: preserve head state for IP_CMSG_PASSSEC") we preserve the secpath for the whole skb lifecycle, but we also end up leaking a reference to it. We must clear the head state on skb reception, if secpath is present.
Unified · Split
| @@ -1176,7 +1176,7 @@ static void udp_set_dev_scratch(struct sk_buff *skb) · 1175 unmodified lines | ||
| 1176 | 1176 | scratch->csum_unnecessary = !!skb_csum_unnecessary(skb); |
| 1177 | 1177 | scratch->is_linear = !skb_is_nonlinear(skb); |
| 1178 | 1178 | #endif |
| 1179 | − if (likely(!skb->_skb_refdst)) | |
| 1179 | + if (likely(!skb->_skb_refdst && !skb_sec_path(skb))) | |
| 1180 | 1180 | scratch->_tsize_state |= UDP_SKB_IS_STATELESS; |
| 1181 | 1181 | } |
| 1182 | 1182 | |