From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758583AbcAUAqp (ORCPT ); Wed, 20 Jan 2016 19:46:45 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:51425 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751647AbcAUAof (ORCPT ); Wed, 20 Jan 2016 19:44:35 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, ying.xue@windriver.com, "David S. Miller" , Ben Hutchings Subject: [PATCH 4.3 03/55] tipc: Fix kfree_skb() of uninitialised pointer Date: Wed, 20 Jan 2016 16:43:38 -0800 Message-Id: <20160120232227.606813369@linuxfoundation.org> X-Mailer: git-send-email 2.7.0 In-Reply-To: <20160120232227.417513468@linuxfoundation.org> References: <20160120232227.417513468@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings Commit 7098356baca7 ("tipc: fix error handling of expanding buffer headroom") added a "goto tx_error". This is fine upstream, but when backported to 4.3 it results in attempting to free the clone before it has been allocated. In this early error case, no cleanup is needed. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- net/tipc/udp_media.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net if (skb_headroom(skb) < UDP_MIN_HEADROOM) { err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC); if (err) - goto tx_error; + return err; } clone = skb_clone(skb, GFP_ATOMIC);