]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
devlink: double free in devlink_resource_fill()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 21 Sep 2018 08:07:55 +0000 (11:07 +0300)
committerDavid S. Miller <davem@davemloft.net>
Sat, 22 Sep 2018 02:19:07 +0000 (19:19 -0700)
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
on error so this is a double free.  We fixed a bunch of these bugs in
commit 7fe4d6dcbcb4 ("devlink: Remove redundant free on error path") but
we accidentally overlooked this one.

Fixes: d9f9b9a4d05f ("devlink: Add support for resource abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/devlink.c

index 65fc366a78a4c455a02e74bdc30c9249698eb488..8c0ed225e2801a741f81eaa6a626eb191884f0aa 100644 (file)
@@ -2592,7 +2592,7 @@ send_done:
        if (!nlh) {
                err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                if (err)
-                       goto err_skb_send_alloc;
+                       return err;
                goto send_done;
        }
        return genlmsg_reply(skb, info);
@@ -2600,7 +2600,6 @@ send_done:
 nla_put_failure:
        err = -EMSGSIZE;
 err_resource_put:
-err_skb_send_alloc:
        nlmsg_free(skb);
        return err;
 }