diff options
| author | Wolfram Sang <wsa+renesas@sang-engineering.com> | 2024-05-13 16:55:19 +0300 |
|---|---|---|
| committer | Wolfram Sang <wsa+renesas@sang-engineering.com> | 2024-05-13 16:55:19 +0300 |
| commit | 10316dcc4f39b2560b372d11be477228b95ae5ac (patch) | |
| tree | bd057ae165b6d19dca6c745da98fb1250d458f19 /net/tipc/msg.c | |
| parent | ed30a4a51bb196781c8058073ea720133a65596f (diff) | |
| parent | 55750148e5595bb85605e8fbb40b2759c2c4c2d7 (diff) | |
| download | linux-10316dcc4f39b2560b372d11be477228b95ae5ac.tar.xz | |
Merge tag 'i2c-host-fixes-6.8-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow
This tag includes two fixes. The first one, in the Cadence driver
seen in Qemu, prevents unintentional FIFO clearing at the
beginning of a transaction. The second fix, in the SynQuacer,
ensures proper error handling during clock get, prepare, and
enable operations by using the devm_clk_get_enabled() helper.
Diffstat (limited to 'net/tipc/msg.c')
| -rw-r--r-- | net/tipc/msg.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 5c9fd4791c4b..76284fc538eb 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - *buf = NULL; if (skb_has_frag_list(frag) && __skb_linearize(frag)) goto err; + *buf = NULL; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; @@ -156,6 +156,11 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (!head) goto err; + /* Either the input skb ownership is transferred to headskb + * or the input skb is freed, clear the reference to avoid + * bad access on error path. + */ + *buf = NULL; if (skb_try_coalesce(head, frag, &headstolen, &delta)) { kfree_skb_partial(frag, headstolen); } else { @@ -179,7 +184,6 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) *headbuf = NULL; return 1; } - *buf = NULL; return 0; err: kfree_skb(*buf); |