diff options
| author | Arkadi Sharshevsky <arkadis@mellanox.com> | 2018-03-08 13:42:10 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-03-31 19:11:34 +0300 |
| commit | b14031144e37fd5f53a6a4a1359d91b0210ca47f (patch) | |
| tree | cea23d61bb9f780e53790371005102bc521fd381 /drivers/net/team | |
| parent | d5862b05903c8b1f49dab92683872854581b9812 (diff) | |
| download | linux-b14031144e37fd5f53a6a4a1359d91b0210ca47f.tar.xz | |
team: Fix double free in error path
[ Upstream commit cbcc607e18422555db569b593608aec26111cb0b ]
The __send_and_alloc_skb() receives a skb ptr as a parameter but in
case it fails the skb is not valid:
- Send failed and released the skb internally.
- Allocation failed.
The current code tries to release the skb in case of failure which
causes redundant freeing.
Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/net/team')
| -rw-r--r-- | drivers/net/team/team.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 26681707fc7a..a0a9c9d39f01 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2403,7 +2403,7 @@ send_done: if (!nlh) { err = __send_and_alloc_skb(&skb, team, portid, send_func); if (err) - goto errout; + return err; goto send_done; } @@ -2688,7 +2688,7 @@ send_done: if (!nlh) { err = __send_and_alloc_skb(&skb, team, portid, send_func); if (err) - goto errout; + return err; goto send_done; } |