net: dsa: ksz: fix skb freeing (e71cb9e0) · Commits · 戴 / test

The DSA layer frees the original skb when an xmit function returns NULL, meaning an error occurred. But if the tagging code copied the original skb, it is responsible of freeing the copy if an error occurs. The ksz tagging code currently has two issues: if skb_put_padto fails, the skb copy is not freed, and the original skb will be freed twice. To fix that, move skb_put_padto inside both branches of the skb_tailroom condition, before freeing the original skb, and free the copy on error. Signed-off-by:

Vivien Didelot <vivien.didelot@savoirfairelinux.com> Reviewed-by:

Woojung Huh <woojung.huh@microchip.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/dsa/tag_ksz.c

+9 −4

Original line number	Original line	Diff line number	Diff line
	@@ -42,6 +42,9 @@ static struct sk_buff ksz_xmit(struct sk_buff skb, struct net_device *dev)
	padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;		padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;

	if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {		if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
			if (skb_put_padto(skb, skb->len + padlen))
			return NULL;

	nskb = skb;		nskb = skb;
	} else {		} else {
	nskb = alloc_skb(NET_IP_ALIGN + skb->len +		nskb = alloc_skb(NET_IP_ALIGN + skb->len +
	@@ -56,12 +59,14 @@ static struct sk_buff ksz_xmit(struct sk_buff skb, struct net_device *dev)
	skb_set_transport_header(nskb,		skb_set_transport_header(nskb,
	skb_transport_header(skb) - skb->head);		skb_transport_header(skb) - skb->head);
	skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));		skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
	kfree_skb(skb);
	}

	/* skb is freed when it fails */		if (skb_put_padto(nskb, nskb->len + padlen)) {
	if (skb_put_padto(nskb, nskb->len + padlen))		kfree_skb(nskb);
	return NULL;		return NULL;
			}

			kfree_skb(skb);
			}

	tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);		tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
	tag[0] = 0;		tag[0] = 0;

Admin message