Commit 6f60f438 authored Apr 20, 2017 by Dan Carpenter Committed by David S. Miller Apr 21, 2017

net: qrtr: potential use after free in qrtr_sendmsg()



If skb_pad() fails then it frees the skb so we should check for errors.

Fixes: bdabad3e ("net: Add Qualcomm IPC router")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 89087c45

net/qrtr/qrtr.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -658,7 +658,9 @@ static int qrtr_sendmsg(struct socket sock, struct msghdr msg, size_t len)
		}

		if (plen != len) {
		skb_pad(skb, plen - len);
		rc = skb_pad(skb, plen - len);
		if (rc)
		goto out_node;
		skb_put(skb, plen - len);
		}