diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-09-21 11:07:55 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-09-22 05:19:07 +0300 |
| commit | 83fe9a966111b51a34f10c35e568e45bff34de48 (patch) | |
| tree | 11945dfd4538b07a1cd32e8093b20b8bbbb1b988 /net | |
| parent | e6ce3822a9f264b3f24c1acdc624131fb014f2f0 (diff) | |
| download | linux-83fe9a966111b51a34f10c35e568e45bff34de48.tar.xz | |
devlink: double free in devlink_resource_fill()
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
on error so this is a double free. We fixed a bunch of these bugs in
commit 7fe4d6dcbcb4 ("devlink: Remove redundant free on error path") but
we accidentally overlooked this one.
Fixes: d9f9b9a4d05f ("devlink: Add support for resource abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/devlink.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/net/core/devlink.c b/net/core/devlink.c index 65fc366a78a4..8c0ed225e280 100644 --- a/net/core/devlink.c +++ b/net/core/devlink.c @@ -2592,7 +2592,7 @@ send_done: if (!nlh) { err = devlink_dpipe_send_and_alloc_skb(&skb, info); if (err) - goto err_skb_send_alloc; + return err; goto send_done; } return genlmsg_reply(skb, info); @@ -2600,7 +2600,6 @@ send_done: nla_put_failure: err = -EMSGSIZE; err_resource_put: -err_skb_send_alloc: nlmsg_free(skb); return err; } |