Commit 83fe9a96 authored Sep 21, 2018 by Dan Carpenter Committed by David S. Miller Sep 21, 2018

devlink: double free in devlink_resource_fill()



Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
on error so this is a double free.  We fixed a bunch of these bugs in
commit 7fe4d6dc ("devlink: Remove redundant free on error path") but
we accidentally overlooked this one.

Fixes: d9f9b9a4 ("devlink: Add support for resource abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent e6ce3822

net/core/devlink.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -2592,7 +2592,7 @@ static int devlink_resource_fill(struct genl_info *info,
		if (!nlh) {
		err = devlink_dpipe_send_and_alloc_skb(&skb, info);
		if (err)
		goto err_skb_send_alloc;
		return err;
		goto send_done;
		}
		return genlmsg_reply(skb, info);
		@@ -2600,7 +2600,6 @@ static int devlink_resource_fill(struct genl_info *info,
		nla_put_failure:
		err = -EMSGSIZE;
		err_resource_put:
		err_skb_send_alloc:
		nlmsg_free(skb);
		return err;
		}