All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
To: amitkarwar@gmail.com, ganapathi.bhat@nxp.com,
	huxinming820@gmail.com, kvalo@codeaurora.org,
	davem@davemloft.net, kuba@kernel.org
Cc: linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Subject: [PATCH] wireless/marvell/mwifiex: Fix a double free in mwifiex_send_tdls_action_frame
Date: Mon, 29 Mar 2021 04:24:35 -0700	[thread overview]
Message-ID: <20210329112435.7960-1-lyl2019@mail.ustc.edu.cn> (raw)

In mwifiex_send_tdls_action_frame, it calls mwifiex_construct_tdls_action_frame
(..,skb). The skb will be freed in mwifiex_construct_tdls_action_frame() when
it is failed. But when mwifiex_construct_tdls_action_frame() returns error,
the skb will be freed in the second time by dev_kfree_skb_any(skb).

My patch removes the redundant dev_kfree_skb_any(skb) when
mwifiex_construct_tdls_action_frame() failed.

Fixes: b23bce2965680 ("mwifiex: add tdls_mgmt handler support")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
 drivers/net/wireless/marvell/mwifiex/tdls.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
index 97bb87c3676b..8d4d0a9cf6ac 100644
--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
+++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
@@ -856,7 +856,6 @@ int mwifiex_send_tdls_action_frame(struct mwifiex_private *priv, const u8 *peer,
 	if (mwifiex_construct_tdls_action_frame(priv, peer, action_code,
 						dialog_token, status_code,
 						skb)) {
-		dev_kfree_skb_any(skb);
 		return -EINVAL;
 	}
 
-- 
2.25.1



             reply	other threads:[~2021-03-29 11:25 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-29 11:24 Lv Yunlong [this message]
2021-04-13 16:08 ` [PATCH] wireless/marvell/mwifiex: Fix a double free in mwifiex_send_tdls_action_frame lyl2019
2021-04-13 17:48   ` Brian Norris

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210329112435.7960-1-lyl2019@mail.ustc.edu.cn \
    --to=lyl2019@mail.ustc.edu.cn \
    --cc=amitkarwar@gmail.com \
    --cc=davem@davemloft.net \
    --cc=ganapathi.bhat@nxp.com \
    --cc=huxinming820@gmail.com \
    --cc=kuba@kernel.org \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.