mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-03 17:40:04 +00:00
net: dsa: skb_put_padto() already frees nskb
The first call of skb_put_padto() will free up the SKB on error, but we
return NULL which tells dsa_slave_xmit() that the original SKB should be
freed so this would lead to a double free here.
The second skb_put_padto() already frees the passed sk_buff reference
upon error, so calling kfree_skb() on it again is not necessary.
Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
Fixes: e71cb9e009
("net: dsa: ksz: fix skb freeing")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Woojung Huh <Woojung.Huh@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
cd0a137acb
commit
4971667924
1 changed files with 6 additions and 4 deletions
|
@ -42,7 +42,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
|
||||
|
||||
if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
|
||||
if (skb_put_padto(skb, skb->len + padlen))
|
||||
/* Let dsa_slave_xmit() free skb */
|
||||
if (__skb_put_padto(skb, skb->len + padlen, false))
|
||||
return NULL;
|
||||
|
||||
nskb = skb;
|
||||
|
@ -60,10 +61,11 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
skb_transport_header(skb) - skb->head);
|
||||
skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
|
||||
|
||||
if (skb_put_padto(nskb, nskb->len + padlen)) {
|
||||
kfree_skb(nskb);
|
||||
/* Let skb_put_padto() free nskb, and let dsa_slave_xmit() free
|
||||
* skb
|
||||
*/
|
||||
if (skb_put_padto(nskb, nskb->len + padlen))
|
||||
return NULL;
|
||||
}
|
||||
|
||||
kfree_skb(skb);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue