diff options
| author | Patrick McHardy <kaber@trash.net> | 2011-04-12 05:39:51 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-04-12 14:38:57 -0700 |
| commit | 0e08785845093ef4ed220463a739bc8d0db95de7 (patch) | |
| tree | e3c9539949a3c00ea2457439bb6f36e5c4842f54 /drivers/connector | |
| parent | 192910a6cca5e50e5bd6cbd1da0e7376c7adfe62 (diff) | |
| download | linux-0e08785845093ef4ed220463a739bc8d0db95de7.tar.bz2 | |
connector: fix skb double free in cn_rx_skb()
When a skb is delivered to a registered callback, cn_call_callback()
incorrectly returns -ENODEV after freeing the skb, causing cn_rx_skb()
to free the skb a second time.
Reported-by: Eric B Munson <emunson@mgebm.net>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Tested-by: Eric B Munson <emunson@mgebm.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/connector')
| -rw-r--r-- | drivers/connector/connector.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c index d77005849af8..219d88a0eeae 100644 --- a/drivers/connector/connector.c +++ b/drivers/connector/connector.c @@ -142,6 +142,7 @@ static int cn_call_callback(struct sk_buff *skb) cbq->callback(msg, nsp); kfree_skb(skb); cn_queue_release_callback(cbq); + err = 0; } return err; |