[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 09 Sep 2017 12:59:04 -0600
From: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
To: Dan Carpenter <dan.carpenter@...cle.com>
Cc: "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
kernel-janitors@...r.kernel.org
Subject: Re: [PATCH v2 net] net: qualcomm: rmnet: Fix a double free
On 2017-09-09 02:58, Dan Carpenter wrote:
> There is a typo here so we accidentally free "skb" instead of "skbn".
> It leads to a double free and a leak. After discussing with Subash,
> it's better to just move the check before the allocation and avoid the
> need to free.
>
> Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial
> implementation")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> ---
> v2: Fix the leak as well. Thanks Subash!
>
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> index 557c9bf1a469..86b8c758f94e 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
> @@ -84,6 +84,10 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff
> *skb)
> if (((int)skb->len - (int)packet_len) < 0)
> return NULL;
>
> + /* Some hardware can send us empty frames. Catch them */
> + if (ntohs(maph->pkt_len) == 0)
> + return NULL;
> +
> skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
> if (!skbn)
> return NULL;
> @@ -94,11 +98,5 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff
> *skb)
> memcpy(skbn->data, skb->data, packet_len);
> skb_pull(skb, packet_len);
>
> - /* Some hardware can send us empty frames. Catch them */
> - if (ntohs(maph->pkt_len) == 0) {
> - kfree_skb(skb);
> - return NULL;
> - }
> -
> return skbn;
> }
Acked-by: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
--
Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project
Powered by blists - more mailing lists