HSI: ssi_protocol: double free in ssip_pn_xmit() (30260501) · Commits · 戴 / test

If skb_pad() fails then it frees skb and we don't need to free it again at the end of the function. Fixes: ("HSI: Introduce driver for SSI Protocol") Signed-off-by:

Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:

Sebastian Reichel <sre@kernel.org>

drivers/hsi/clients/ssi_protocol.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -980,7 +980,7 @@ static int ssip_pn_xmit(struct sk_buff skb, struct net_device dev)
		goto drop;
		/* Pad to 32-bits - FIXME: Revisit*/
		if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3)))
		goto drop;
		goto inc_dropped;

		/*
		* Modem sends Phonet messages over SSI with its own endianess...
		@@ -1032,8 +1032,9 @@ static int ssip_pn_xmit(struct sk_buff skb, struct net_device dev)
		drop2:
		hsi_free_msg(msg);
		drop:
		dev->stats.tx_dropped++;
		dev_kfree_skb(skb);
		inc_dropped:
		dev->stats.tx_dropped++;

		return 0;
		}

Admin message