Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f4f554a authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

net: qualcomm: rmnet: Fix a double free 



There is a typo here so we accidentally free "skb" instead of "skbn".
It leads to a double free and a leak.  After discussing with Subash,
it's better to just move the check before the allocation and avoid the
need to free.

Fixes: ceed73a2 ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarSubash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ad9a19d0

drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c

+4 −6
Original line number Diff line number Diff line
@@ -84,6 +84,10 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb) 
	if (((int)skb->len - (int)packet_len) < 0)

		return NULL;



	/* Some hardware can send us empty frames. Catch them */

	if (ntohs(maph->pkt_len) == 0)

		return NULL;



	skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);

	if (!skbn)

		return NULL;
@@ -94,11 +98,5 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb) 
	memcpy(skbn->data, skb->data, packet_len);

	skb_pull(skb, packet_len);



	/* Some hardware can send us empty frames. Catch them */

	if (ntohs(maph->pkt_len) == 0) {

		kfree_skb(skb);

		return NULL;

	}



	return skbn;

}