Commit 7eaf5077 authored by John Fastabend's avatar John Fastabend Committed by David S. Miller
Browse files

net: fix double skb free in dcbnl 



netlink_unicast() calls kfree_skb even in the error case.

dcbnl calls netlink_unicast() which when it fails free's the
skb and returns an error value.  dcbnl is free'ing the skb
again when this error occurs.  This patch removes the double
free.

Signed-off-by: default avatarJohn Fastabend <john.r.fastabend@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 5dba93ae

net/dcb/dcbnl.c

+7 −8
Original line number Original line Diff line number Diff line
@@ -194,7 +194,7 @@ static int dcbnl_reply(u8 value, u8 event, u8 cmd, u8 attr, u32 pid, 
	nlmsg_end(dcbnl_skb, nlh);

	nlmsg_end(dcbnl_skb, nlh);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret)

	if (ret)

		goto err;

		return -EINVAL;





	return 0;

	return 0;

nlmsg_failure:

nlmsg_failure:
@@ -275,7 +275,7 @@ static int dcbnl_getpfccfg(struct net_device *netdev, struct nlattr **tb, 




	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret)

	if (ret)

		goto err;

		goto err_out;





	return 0;

	return 0;

nlmsg_failure:

nlmsg_failure:
@@ -316,12 +316,11 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb, 




	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret)

	if (ret)

		goto err;

		goto err_out;





	return 0;

	return 0;





nlmsg_failure:

nlmsg_failure:

err:

	kfree_skb(dcbnl_skb);

	kfree_skb(dcbnl_skb);

err_out:

err_out:

	return -EINVAL;

	return -EINVAL;
@@ -383,7 +382,7 @@ static int dcbnl_getcap(struct net_device *netdev, struct nlattr **tb, 




	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret)

	if (ret)

		goto err;

		goto err_out;





	return 0;

	return 0;

nlmsg_failure:

nlmsg_failure:
@@ -460,7 +459,7 @@ static int dcbnl_getnumtcs(struct net_device *netdev, struct nlattr **tb, 
	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret) {

	if (ret) {

		ret = -EINVAL;

		ret = -EINVAL;

		goto err;

		goto err_out;

	}

	}





	return 0;

	return 0;
@@ -799,7 +798,7 @@ static int __dcbnl_pg_getcfg(struct net_device *netdev, struct nlattr **tb, 




	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret)

	if (ret)

		goto err;

		goto err_out;





	return 0;

	return 0;
@@ -1063,7 +1062,7 @@ static int dcbnl_bcn_getcfg(struct net_device *netdev, struct nlattr **tb, 




	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	ret = rtnl_unicast(dcbnl_skb, &init_net, pid);

	if (ret)

	if (ret)

		goto err;

		goto err_out;





	return 0;

	return 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE