From: Dan Carpenter <dan.carpenter@oracle.com>
To: Kalle Valo <kvalo@codeaurora.org>, Philip Rakity <prakity@yahoo.com>
Cc: Allison Randal <allison@lohutok.net>,
Lubomir Rintel <lkundrak@v3.sk>,
libertas-dev@lists.infradead.org, linux-wireless@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: [PATCH] libertas: Fix a double free in if_spi_c2h_data()
Date: Wed, 26 Jun 2019 10:09:26 +0000 [thread overview]
Message-ID: <20190626100926.GD3242@mwanda> (raw)
The lbs_process_rxed_packet() frees the skb. It didn't originally, but
we fixed it in commit f54930f36311 ("libertas: don't leak skb on receive
error").
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/marvell/libertas/if_spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/if_spi.c b/drivers/net/wireless/marvell/libertas/if_spi.c
index 27067e79e83f..e38f02d1f2e4 100644
--- a/drivers/net/wireless/marvell/libertas/if_spi.c
+++ b/drivers/net/wireless/marvell/libertas/if_spi.c
@@ -772,7 +772,7 @@ static int if_spi_c2h_data(struct if_spi_card *card)
/* pass the SKB to libertas */
err = lbs_process_rxed_packet(card->priv, skb);
if (err)
- goto free_skb;
+ goto out; /* lbs_process_rxed_packet() frees skb */
/* success */
goto out;
--
2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Kalle Valo <kvalo@codeaurora.org>, Philip Rakity <prakity@yahoo.com>
Cc: Allison Randal <allison@lohutok.net>,
Lubomir Rintel <lkundrak@v3.sk>,
libertas-dev@lists.infradead.org, linux-wireless@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: [PATCH] libertas: Fix a double free in if_spi_c2h_data()
Date: Wed, 26 Jun 2019 13:09:26 +0300 [thread overview]
Message-ID: <20190626100926.GD3242@mwanda> (raw)
The lbs_process_rxed_packet() frees the skb. It didn't originally, but
we fixed it in commit f54930f36311 ("libertas: don't leak skb on receive
error").
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/marvell/libertas/if_spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/libertas/if_spi.c b/drivers/net/wireless/marvell/libertas/if_spi.c
index 27067e79e83f..e38f02d1f2e4 100644
--- a/drivers/net/wireless/marvell/libertas/if_spi.c
+++ b/drivers/net/wireless/marvell/libertas/if_spi.c
@@ -772,7 +772,7 @@ static int if_spi_c2h_data(struct if_spi_card *card)
/* pass the SKB to libertas */
err = lbs_process_rxed_packet(card->priv, skb);
if (err)
- goto free_skb;
+ goto out; /* lbs_process_rxed_packet() frees skb */
/* success */
goto out;
--
2.20.1
next reply other threads:[~2019-06-26 10:09 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-26 10:09 Dan Carpenter [this message]
2019-06-26 10:09 ` [PATCH] libertas: Fix a double free in if_spi_c2h_data() Dan Carpenter
2019-06-26 13:16 ` Dan Williams
2019-06-26 13:16 ` Dan Williams
2019-06-26 13:23 ` Dan Carpenter
2019-06-26 13:23 ` Dan Carpenter
2019-06-26 16:02 ` Dan Williams
2019-06-26 16:02 ` Dan Williams
2019-07-05 16:42 ` [PATCH v2] " Dan Williams
2019-07-05 16:42 ` Dan Williams
2019-07-24 11:46 ` Kalle Valo
2019-07-24 11:46 ` Kalle Valo
2019-07-24 14:38 ` [PATCH v3] " Dan Williams
2019-07-24 14:38 ` Dan Williams
2019-08-06 12:36 ` Kalle Valo
2019-08-06 12:36 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190626100926.GD3242@mwanda \
--to=dan.carpenter@oracle.com \
--cc=allison@lohutok.net \
--cc=kernel-janitors@vger.kernel.org \
--cc=kvalo@codeaurora.org \
--cc=libertas-dev@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lkundrak@v3.sk \
--cc=prakity@yahoo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.