summaryrefslogtreecommitdiffstats
path: root/net/core
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2018-09-21 11:07:55 +0300
committerDavid S. Miller <davem@davemloft.net>2018-09-21 19:19:07 -0700
commit83fe9a966111b51a34f10c35e568e45bff34de48 (patch)
tree11945dfd4538b07a1cd32e8093b20b8bbbb1b988 /net/core
parente6ce3822a9f264b3f24c1acdc624131fb014f2f0 (diff)
downloadlinux-83fe9a966111b51a34f10c35e568e45bff34de48.tar.bz2
devlink: double free in devlink_resource_fill()
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb on error so this is a double free. We fixed a bunch of these bugs in commit 7fe4d6dcbcb4 ("devlink: Remove redundant free on error path") but we accidentally overlooked this one. Fixes: d9f9b9a4d05f ("devlink: Add support for resource abstraction") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/devlink.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 65fc366a78a4..8c0ed225e280 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -2592,7 +2592,7 @@ send_done:
if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&skb, info);
if (err)
- goto err_skb_send_alloc;
+ return err;
goto send_done;
}
return genlmsg_reply(skb, info);
@@ -2600,7 +2600,6 @@ send_done:
nla_put_failure:
err = -EMSGSIZE;
err_resource_put:
-err_skb_send_alloc:
nlmsg_free(skb);
return err;
}