diff options
| author | Lv Yunlong <lyl2019@mail.ustc.edu.cn> | 2021-03-28 10:50:08 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-03-29 04:08:43 +0300 |
| commit | 1b479fb801602b22512f53c19b1f93a4fc5d5d9d (patch) | |
| tree | 52ded9bf40711d25bbbbb025a939a8a0e6258212 | |
| parent | 75887e881b19c903d34b7cc33e7e6188679d9752 (diff) | |
| download | linux-1b479fb801602b22512f53c19b1f93a4fc5d5d9d.tar.xz | |
drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
In pvc_xmit, if __skb_pad(skb, pad, false) failed, it will free
the skb in the first time and goto drop. But the same skb is freed
by kfree_skb(skb) in the second time in drop.
Maintaining the original function unchanged, my patch adds a new
label out to avoid the double free if __skb_pad() failed.
Fixes: f5083d0cee08a ("drivers/net/wan/hdlc_fr: Improvements to the code of pvc_xmit")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/wan/hdlc_fr.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c index 0720f5f92caa..4d9dc7d15908 100644 --- a/drivers/net/wan/hdlc_fr.c +++ b/drivers/net/wan/hdlc_fr.c @@ -415,7 +415,7 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) if (pad > 0) { /* Pad the frame with zeros */ if (__skb_pad(skb, pad, false)) - goto drop; + goto out; skb_put(skb, pad); } } @@ -448,8 +448,9 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) return NETDEV_TX_OK; drop: - dev->stats.tx_dropped++; kfree_skb(skb); +out: + dev->stats.tx_dropped++; return NETDEV_TX_OK; } |