* [PATCH net] devlink: double free in devlink_resource_fill()
@ 2018-09-21 8:07 Dan Carpenter
2018-09-23 17:20 ` Jiri Pirko
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2018-09-21 8:07 UTC (permalink / raw)
To: Jiri Pirko; +Cc: David S. Miller, netdev, kernel-janitors
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
on error so this is a double free. We fixed a bunch of these bugs in
commit 7fe4d6dcbcb4 ("devlink: Remove redundant free on error path") but
we accidentally overlooked this one.
Fixes: d9f9b9a4d05f ("devlink: Add support for resource abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 65fc366a78a4..8c0ed225e280 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -2592,7 +2592,7 @@ static int devlink_resource_fill(struct genl_info *info,
if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&skb, info);
if (err)
- goto err_skb_send_alloc;
+ return err;
goto send_done;
}
return genlmsg_reply(skb, info);
@@ -2600,7 +2600,6 @@ static int devlink_resource_fill(struct genl_info *info,
nla_put_failure:
err = -EMSGSIZE;
err_resource_put:
-err_skb_send_alloc:
nlmsg_free(skb);
return err;
}
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] devlink: double free in devlink_resource_fill()
2018-09-21 8:07 [PATCH net] devlink: double free in devlink_resource_fill() Dan Carpenter
@ 2018-09-23 17:20 ` Jiri Pirko
0 siblings, 0 replies; 2+ messages in thread
From: Jiri Pirko @ 2018-09-23 17:20 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Jiri Pirko, David S. Miller, netdev, kernel-janitors
Fri, Sep 21, 2018 at 10:07:55AM CEST, dan.carpenter@oracle.com wrote:
>Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
>on error so this is a double free. We fixed a bunch of these bugs in
>commit 7fe4d6dcbcb4 ("devlink: Remove redundant free on error path") but
>we accidentally overlooked this one.
>
>Fixes: d9f9b9a4d05f ("devlink: Add support for resource abstraction")
>Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-09-23 23:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-21 8:07 [PATCH net] devlink: double free in devlink_resource_fill() Dan Carpenter
2018-09-23 17:20 ` Jiri Pirko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).