]> git.ipfire.org Git - thirdparty/linux.git/commit
netdev: fix double-free in netdev_nl_bind_rx_doit()
authorJakub Kicinski <kuba@kernel.org>
Sat, 6 Jun 2026 01:21:24 +0000 (18:21 -0700)
committerJakub Kicinski <kuba@kernel.org>
Tue, 9 Jun 2026 00:40:20 +0000 (17:40 -0700)
commitc849de7d8757a7af801fc4a4058f71d481d367f2
tree78b57e6acb055bae16559984441371c4b7f42457
parent71de0177b28da751f407581a4515cf4d762f6296
netdev: fix double-free in netdev_nl_bind_rx_doit()

Sashiko flags that genlmsg_reply() always consumes the skb.
The error path calls nlmsg_free(rsp) so we can't jump directly
to it. Let's not unbind, just propagate the error to the user.
This is the typical way of handling genlmsg_reply() failures.
They shouldn't happen unless user does something silly like
calling the kernel with an already-full rcvbuf.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 170aafe35cb9 ("netdev: support binding dma-buf to netdevice")
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/core/netdev-genl.c