[PATCH net] team: Fix double free in error path

[PATCH net] team: Fix double free in error path

[Arkadi Sharshevsky]

The __send_and_alloc_skb() receives a skb ptr as a parameter but in
case it fails the skb is not valid:
- Send failed and released the skb internally.
- Allocation failed.

The current code tries to release the skb in case of failure which
causes redundant freeing.

Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
---
 drivers/net/team/team.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index a468439..56c701b 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2395,7 +2395,7 @@ static int team_nl_send_options_get(struct team *team, u32 portid, u32 seq,
 	if (!nlh) {
 		err = __send_and_alloc_skb(&skb, team, portid, send_func);
 		if (err)
-			goto errout;
+			return err;
 		goto send_done;
 	}
 
@@ -2681,7 +2681,7 @@ static int team_nl_send_port_list_get(struct team *team, u32 portid, u32 seq,
 	if (!nlh) {
 		err = __send_and_alloc_skb(&skb, team, portid, send_func);
 		if (err)
-			goto errout;
+			return err;
 		goto send_done;
 	}
 
-- 
2.4.11

Re: [PATCH net] team: Fix double free in error path

[David Miller]

From: Arkadi Sharshevsky <arkadis@mellanox.com>
Date: Thu,  8 Mar 2018 12:42:10 +0200

> The __send_and_alloc_skb() receives a skb ptr as a parameter but in
> case it fails the skb is not valid:
> - Send failed and released the skb internally.
> - Allocation failed.
> 
> The current code tries to release the skb in case of failure which
> causes redundant freeing.
> 
> Fixes: 9b00cf2d1024 ("team: implement multipart netlink messages for options transfers")
> Signed-off-by: Arkadi Sharshevsky <arkadis@mellanox.com>
> Acked-by: Jiri Pirko <jiri@mellanox.com>

Indeed, all of the team send functions call down into either multicast
or unicast netlink sends, which either free or consume the SKB.

Applied and queued up for -stable, thanks.