| Message ID | 1520505730-48057-1-git-send-email-arkadis@mellanox.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] team: Fix double free in error path | expand |
From: Arkadi Sharshevsky <arkadis@mellanox.com> Date: Thu, 8 Mar 2018 12:42:10 +0200 > The __send_and_alloc_skb() receives a skb ptr as a parameter but in > case it fails the skb is not valid: > - Send failed and released the skb internally. > - Allocation failed. > > The current code tries to release the skb in case of failure which > causes redundant freeing. > > Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers") > Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com> > Acked-by: Jiri Pirko <jiri@mellanox.com> Indeed, all of the team send functions call down into either multicast or unicast netlink sends, which either free or consume the SKB. Applied and queued up for -stable, thanks.
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index a468439..56c701b 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2395,7 +2395,7 @@ static int team_nl_send_options_get(struct team *team, u32 portid, u32 seq, if (!nlh) { err = __send_and_alloc_skb(&skb, team, portid, send_func); if (err) - goto errout; + return err; goto send_done; } @@ -2681,7 +2681,7 @@ static int team_nl_send_port_list_get(struct team *team, u32 portid, u32 seq, if (!nlh) { err = __send_and_alloc_skb(&skb, team, portid, send_func); if (err) - goto errout; + return err; goto send_done; }
The __send_and_alloc_skb() receives a skb ptr as a parameter but in case it fails the skb is not valid: - Send failed and released the skb internally. - Allocation failed. The current code tries to release the skb in case of failure which causes redundant freeing. Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers") Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com> Acked-by: Jiri Pirko <jiri@mellanox.com> --- drivers/net/team/team.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)