can: rx-offload: can_rx_offload_queue_sorted(): fix error handling, avoid skb mem leak

If the rx-offload skb_queue is full can_rx_offload_queue_sorted() will not queue the skb and return with an error. None of the callers of this function, issue a kfree_skb() to free the not queued skb. This results in a memory leak. This patch fixes the problem by freeing the skb in case of a full queue. The return value is adjusted to -ENOBUFS to better reflect the actual problem. The device stats handling is left to the callers, as this function might be used in both the rx and tx path. Fixes: 55059f2 ("can: rx-offload: introduce can_rx_offload_get_echo_skb() and can_rx_offload_queue_sorted() functions") Cc: linux-stable <stable@vger.kernel.org> Cc: Martin Hundebøll <martin@geanix.com> Reported-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Author: marckleinebudde

drivers/net/can/rx-offload.c

@@ -207,8 +207,10 @@ int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
 unsigned long flags;
 
 if (skb_queue_len(&offload->skb_queue) >
- offload->skb_queue_len_max)
-return -ENOMEM;
+ offload->skb_queue_len_max) {
+kfree_skb(skb);
+return -ENOBUFS;
+}
 
 cb = can_rx_offload_get_cb(skb);
 cb->timestamp = timestamp;