From 7e9a62dd8e8d69e96ad5af445bacf27e0723160e Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Mon, 28 Nov 2022 10:52:23 -0500 Subject: [PATCH] MT#55283 explicitly track `skb` To make sure we always release the `skb` that is passed to us, be explicit about when we have used it up (sent it out), so that we can free it at function exit when we haven't. Change-Id: I8ecff0ba54bbb64104b9125a2b8748667f08c42a --- kernel-module/xt_RTPENGINE.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c index 6bc041665..ccba89e58 100644 --- a/kernel-module/xt_RTPENGINE.c +++ b/kernel-module/xt_RTPENGINE.c @@ -4501,6 +4501,7 @@ static unsigned int rtpengine46(struct sk_buff *skb, struct rtpengine_table *t, #if (RE_HAS_MEASUREDELAY) uint64_t starttime, endtime, delay; + ktime_t tstamp = skb->tstamp; #endif skb_reset_transport_header(skb); @@ -4656,8 +4657,11 @@ no_intercept: for (i = 0; i < g->target.num_destinations; i++) { struct rtpengine_output *o = &g->outputs[i]; // do we need a copy? - if (i == (g->target.num_destinations - 1)) + if (i == (g->target.num_destinations - 1)) { skb2 = skb; // last iteration - use original + skb = NULL; + offset = 0; + } else { // make copy skb2 = skb_copy_expand(skb, MAX_HEADER, MAX_SKB_TAIL_ROOM, GFP_ATOMIC); @@ -4666,9 +4670,9 @@ no_intercept: atomic64_inc(&g->stats_in.errors); continue; } + offset = skb2->data - skb->data; } // adjust RTP pointers - offset = skb2->data - skb->data; rtp2 = rtp; rtp2.header = (void *) (((char *) rtp2.header) + offset); rtp2.payload = (void *) (((char *) rtp2.payload) + offset); @@ -4721,7 +4725,7 @@ no_intercept: atomic64_add(datalen, &g->rtp_stats[rtp_pt_idx].bytes); #if (RE_HAS_MEASUREDELAY) - starttime = ktime_to_ns(skb->tstamp); + starttime = ktime_to_ns(tstamp); endtime = ktime_to_ns(ktime_get_real()); delay = endtime - starttime; @@ -4752,6 +4756,8 @@ no_intercept: target_put(g); table_put(t); + if (skb) + kfree_skb(skb); return NF_DROP;