diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-09-09 10:58:03 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-09-09 23:33:27 +0200 |
| commit | 1f4f554a72be0d8c164c2f5bc6ba939a1c624fb4 (patch) | |
| tree | 4805767bc7adc50a31c1469ab62b2dd1085f1be3 /drivers | |
| parent | Merge tag 'nfsd-4.14' of git://linux-nfs.org/~bfields/linux (diff) | |
| download | linux-1f4f554a72be0d8c164c2f5bc6ba939a1c624fb4.tar.xz linux-1f4f554a72be0d8c164c2f5bc6ba939a1c624fb4.zip | |
net: qualcomm: rmnet: Fix a double free
There is a typo here so we accidentally free "skb" instead of "skbn".
It leads to a double free and a leak. After discussing with Subash,
it's better to just move the check before the allocation and avoid the
need to free.
Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c index 557c9bf1a469..86b8c758f94e 100644 --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c @@ -84,6 +84,10 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb) if (((int)skb->len - (int)packet_len) < 0) return NULL; + /* Some hardware can send us empty frames. Catch them */ + if (ntohs(maph->pkt_len) == 0) + return NULL; + skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC); if (!skbn) return NULL; @@ -94,11 +98,5 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb) memcpy(skbn->data, skb->data, packet_len); skb_pull(skb, packet_len); - /* Some hardware can send us empty frames. Catch them */ - if (ntohs(maph->pkt_len) == 0) { - kfree_skb(skb); - return NULL; - } - return skbn; } |