diff options
| author |   David S. Miller <davem@davemloft.net> | 2017-08-23 20:33:49 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-08-23 20:33:49 -0700 |
| commit | 2f19f50e0f55a8fa067d3705e3f812a4f709567f (patch) | |
| tree | 75ab119854f9db3c887341aa214c0332ac945b5e /net/dsa/tag_ksz.c | |
| parent | net: stmmac: socfgpa: Ensure emac bit set in sys manager for MII/GMII/SGMII. (diff) | |
| parent | net: dsa: skb_put_padto() already frees nskb (diff) | |
| download | linux-dev-2f19f50e0f55a8fa067d3705e3f812a4f709567f.tar.xz linux-dev-2f19f50e0f55a8fa067d3705e3f812a4f709567f.zip | |
Merge branch 'dst-tag-ksz-fix'
Florian Fainelli says:
====================
net: dsa: Fix tag_ksz.c
This implements David's suggestion of providing low-level functions
to control whether skb_pad() and skb_put_padto() should be freeing
the passed skb.
We make use of it to fix a double free in net/dsa/tag_ksz.c that would
occur if we kept using skb_put_padto() in both places.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/dsa/tag_ksz.c')
| -rw-r--r-- | net/dsa/tag_ksz.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c index de66ca8e6201..3bd6e2a83125 100644 --- a/net/dsa/tag_ksz.c +++ b/net/dsa/tag_ksz.c @@ -42,7 +42,8 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev) padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len; if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) { - if (skb_put_padto(skb, skb->len + padlen)) + /* Let dsa_slave_xmit() free skb */ + if (__skb_put_padto(skb, skb->len + padlen, false)) return NULL; nskb = skb; @@ -60,10 +61,11 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev) skb_transport_header(skb) - skb->head); skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len)); - if (skb_put_padto(nskb, nskb->len + padlen)) { - kfree_skb(nskb); + /* Let skb_put_padto() free nskb, and let dsa_slave_xmit() free + * skb + */ + if (skb_put_padto(nskb, nskb->len + padlen)) return NULL; - } kfree_skb(skb); } |