]>
Commit | Line | Data |
---|---|---|
66d1cac4 GKH |
1 | From foo@baz Thu Mar 29 08:53:48 CEST 2018 |
2 | From: Arkadi Sharshevsky <arkadis@mellanox.com> | |
3 | Date: Thu, 8 Mar 2018 12:42:10 +0200 | |
4 | Subject: team: Fix double free in error path | |
5 | ||
6 | From: Arkadi Sharshevsky <arkadis@mellanox.com> | |
7 | ||
8 | ||
9 | [ Upstream commit cbcc607e18422555db569b593608aec26111cb0b ] | |
10 | ||
11 | The __send_and_alloc_skb() receives a skb ptr as a parameter but in | |
12 | case it fails the skb is not valid: | |
13 | - Send failed and released the skb internally. | |
14 | - Allocation failed. | |
15 | ||
16 | The current code tries to release the skb in case of failure which | |
17 | causes redundant freeing. | |
18 | ||
19 | Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers") | |
20 | Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com> | |
21 | Acked-by: Jiri Pirko <jiri@mellanox.com> | |
22 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
23 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
24 | --- | |
25 | drivers/net/team/team.c | 4 ++-- | |
26 | 1 file changed, 2 insertions(+), 2 deletions(-) | |
27 | ||
28 | --- a/drivers/net/team/team.c | |
29 | +++ b/drivers/net/team/team.c | |
30 | @@ -2368,7 +2368,7 @@ send_done: | |
31 | if (!nlh) { | |
32 | err = __send_and_alloc_skb(&skb, team, portid, send_func); | |
33 | if (err) | |
34 | - goto errout; | |
35 | + return err; | |
36 | goto send_done; | |
37 | } | |
38 | ||
39 | @@ -2648,7 +2648,7 @@ send_done: | |
40 | if (!nlh) { | |
41 | err = __send_and_alloc_skb(&skb, team, portid, send_func); | |
42 | if (err) | |
43 | - goto errout; | |
44 | + return err; | |
45 | goto send_done; | |
46 | } | |
47 |