Skip to content
Commit 09048e0a authored by Chaitanya Tata's avatar Chaitanya Tata Committed by Carles Cufí
Browse files

net: ipv6: mld: Fix improper reference drop



In case of successful submission, the reference shouldn't be put down,
this only should done on error cases.

As reference is put down on success, during the buffer unref, no action
is taken due to an uint8 overflow (ref is now 255), so, the buf->frags
isn't cleared properly and the next time the frags is used and when L2
inserts a second frag, the first head frag and next frag are same (due
to buffer re-use) causing an infinite loop in either net_buf_frag_last
or net_pkt_get_len.

Signed-off-by: default avatarChaitanya Tata <Chaitanya.Tata@nordicsemi.no>
parent e40c8757
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment