[PATCH] chtls: Fix skb reference leak in chtls_send_reset()

[Wentao Liang]

chtls_send_reset() is given a skb holding one reference, to be sent as
CPL_ABORT_REQ. It consumes that reference on every path except the
TCP_SYN_RECV one: there it sends a TCB field reply built from a freshly
allocated skb and never releases the passed-in one.

This leaks the reference taken by reset_listen_child(), which resets
half-open children in TCP_SYN_RECV found on the SYN queue.

Release the skb on the TCP_SYN_RECV path as well.

Fixes: 8ad2a970d201 ("cxgb4/chtls: Fix tid stuck due to wrong update of qid")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
index 0e3e5cf52c2c..a363f20452fa 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
@@ -265,12 +265,14 @@ static void chtls_send_reset(struct sock *sk, int mode, struct sk_buff *skb)
 	chtls_purge_write_queue(sk);
 
 	csk_set_flag(csk, CSK_ABORT_SHUTDOWN);
-	if (sk->sk_state != TCP_SYN_RECV)
+	if (sk->sk_state != TCP_SYN_RECV) {
 		chtls_send_abort(sk, mode, skb);
-	else
+	} else {
 		chtls_set_tcb_field_rpl_skb(sk, TCB_T_FLAGS_W,
 					    TCB_T_FLAGS_V(TCB_T_FLAGS_M), 0,
 					    TCB_FIELD_COOKIE_TFLAG, 1);
+		kfree_skb(skb);
+	}
 
 	return;
 out:
-- 
2.34.1