summaryrefslogtreecommitdiffstats
path: root/drivers/net/ethernet/qualcomm
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2017-09-09 11:58:03 +0300
committerDavid S. Miller <davem@davemloft.net>2017-09-09 14:33:27 -0700
commit1f4f554a72be0d8c164c2f5bc6ba939a1c624fb4 (patch)
tree4805767bc7adc50a31c1469ab62b2dd1085f1be3 /drivers/net/ethernet/qualcomm
parentad9a19d003703ae06a6e8efc64cf26a939d9e84d (diff)
downloadlinux-1f4f554a72be0d8c164c2f5bc6ba939a1c624fb4.tar.bz2
net: qualcomm: rmnet: Fix a double free
There is a typo here so we accidentally free "skb" instead of "skbn". It leads to a double free and a leak. After discussing with Subash, it's better to just move the check before the allocation and avoid the need to free. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/qualcomm')
-rw-r--r--drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c10
1 files changed, 4 insertions, 6 deletions
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 557c9bf1a469..86b8c758f94e 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -84,6 +84,10 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb)
if (((int)skb->len - (int)packet_len) < 0)
return NULL;
+ /* Some hardware can send us empty frames. Catch them */
+ if (ntohs(maph->pkt_len) == 0)
+ return NULL;
+
skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
if (!skbn)
return NULL;
@@ -94,11 +98,5 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb)
memcpy(skbn->data, skb->data, packet_len);
skb_pull(skb, packet_len);
- /* Some hardware can send us empty frames. Catch them */
- if (ntohs(maph->pkt_len) == 0) {
- kfree_skb(skb);
- return NULL;
- }
-
return skbn;
}