Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 49716679 authored by Florian Fainelli's avatar Florian Fainelli Committed by David S. Miller
Browse files

net: dsa: skb_put_padto() already frees nskb 



The first call of skb_put_padto() will free up the SKB on error, but we
return NULL which tells dsa_slave_xmit() that the original SKB should be
freed so this would lead to a double free here.

The second skb_put_padto() already frees the passed sk_buff reference
upon error, so calling kfree_skb() on it again is not necessary.

Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")

Fixes: e71cb9e0 ("net: dsa: ksz: fix skb freeing")
Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Reviewed-by: default avatarWoojung Huh <Woojung.Huh@microchip.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cd0a137a

net/dsa/tag_ksz.c

+6 −4
Original line number Diff line number Diff line
@@ -42,7 +42,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev) 
	padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;



	if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {

		if (skb_put_padto(skb, skb->len + padlen))

		/* Let dsa_slave_xmit() free skb */

		if (__skb_put_padto(skb, skb->len + padlen, false))

			return NULL;



		nskb = skb;
@@ -60,10 +61,11 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev) 
					 skb_transport_header(skb) - skb->head);

		skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));



		if (skb_put_padto(nskb, nskb->len + padlen)) {

			kfree_skb(nskb);

		/* Let skb_put_padto() free nskb, and let dsa_slave_xmit() free

		 * skb

		 */

		if (skb_put_padto(nskb, nskb->len + padlen))

			return NULL;

		}



		kfree_skb(skb);

	}