| Message ID | 20221216235742.646134-1-miquel.raynal@bootlin.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [wpan] mac802154: Fix possible double free upon parsing error | expand |
Hello. On 17.12.22 00:57, Miquel Raynal wrote: > Commit 4d1c7d87030b ("mac802154: Move an skb free within the rx path") > tried to simplify error handling within the receive path by moving the > kfree_skb() call at the very end of the top-level function but missed > one kfree_skb() called upon frame parsing error. Prevent this possible > double free from happening. > > Fixes: 4d1c7d87030b ("mac802154: Move an skb free within the rx path") > Reported-by: Dan Carpenter <error27@gmail.com> > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> > --- > net/mac802154/rx.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c > index c2aae2a6d6a6..97bb4401dd3e 100644 > --- a/net/mac802154/rx.c > +++ b/net/mac802154/rx.c > @@ -213,7 +213,6 @@ __ieee802154_rx_handle_packet(struct ieee802154_local *local, > ret = ieee802154_parse_frame_start(skb, &hdr); > if (ret) { > pr_debug("got invalid frame\n"); > - kfree_skb(skb); > return; > } > This patch has been applied to the wpan tree and will be part of the next pull request to net. Thanks! regards Stefan Schmidt
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c index c2aae2a6d6a6..97bb4401dd3e 100644 --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -213,7 +213,6 @@ __ieee802154_rx_handle_packet(struct ieee802154_local *local, ret = ieee802154_parse_frame_start(skb, &hdr); if (ret) { pr_debug("got invalid frame\n"); - kfree_skb(skb); return; }
Commit 4d1c7d87030b ("mac802154: Move an skb free within the rx path") tried to simplify error handling within the receive path by moving the kfree_skb() call at the very end of the top-level function but missed one kfree_skb() called upon frame parsing error. Prevent this possible double free from happening. Fixes: 4d1c7d87030b ("mac802154: Move an skb free within the rx path") Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> --- net/mac802154/rx.c | 1 - 1 file changed, 1 deletion(-)