leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

devlink: double free in devlink_resource_fill()

Browse Source 
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
on error so this is a double free.  We fixed a bunch of these bugs in
commit 7fe4d6dcbc ("devlink: Remove redundant free on error path") but
we accidentally overlooked this one.

Fixes: d9f9b9a4d0 ("devlink: Add support for resource abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2018-09-21 11:07:55 +03:00 committed by David S. Miller
parent e6ce3822a9
commit 83fe9a9661
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/core/devlink.c
View File

@ -2592,7 +2592,7 @@ send_done:
if (!nlh) { if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&skb, info); err = devlink_dpipe_send_and_alloc_skb(&skb, info);
if (err) if (err)
goto err_skb_send_alloc; return err;
goto send_done; goto send_done;
} }
return genlmsg_reply(skb, info); return genlmsg_reply(skb, info);
@ -2600,7 +2600,6 @@ send_done:
nla_put_failure: nla_put_failure:
err = -EMSGSIZE; err = -EMSGSIZE;
err_resource_put: err_resource_put:
err_skb_send_alloc:
nlmsg_free(skb); nlmsg_free(skb);
return err; return err;
} }