Skip to content

Commit

Permalink
devlink: double free in devlink_resource_fill()
Browse files Browse the repository at this point in the history
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb
on error so this is a double free.  We fixed a bunch of these bugs in
commit 7fe4d6d ("devlink: Remove redundant free on error path") but
we accidentally overlooked this one.

Fixes: d9f9b9a ("devlink: Add support for resource abstraction")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Dan Carpenter authored and lshw committed Mar 20, 2023
1 parent a99cbcd commit e60fdcc
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions net/core/devlink.c
Original file line number Diff line number Diff line change
Expand Up @@ -2592,15 +2592,14 @@ static int devlink_resource_fill(struct genl_info *info,
if (!nlh) {
err = devlink_dpipe_send_and_alloc_skb(&skb, info);
if (err)
goto err_skb_send_alloc;
return err;
goto send_done;
}
return genlmsg_reply(skb, info);

nla_put_failure:
err = -EMSGSIZE;
err_resource_put:
err_skb_send_alloc:
nlmsg_free(skb);
return err;
}
Expand Down

0 comments on commit e60fdcc

Please sign in to comment.