diff options
| author | Miquel Raynal <miquel.raynal@bootlin.com> | 2022-12-17 00:57:42 +0100 |
|---|---|---|
| committer | Stefan Schmidt <stefan@datenfreihafen.org> | 2022-12-19 11:38:12 +0100 |
| commit | 71a06f1034b91e15d3ba6b5539c7d3a2d7f13030 (patch) | |
| tree | acca650d1be2e7a04ae79f848059f28c41367690 | |
| parent | 9cd3fd2054c3b3055163accbf2f31a4426f10317 (diff) | |
| download | linux-stable-71a06f1034b91e15d3ba6b5539c7d3a2d7f13030.tar.gz linux-stable-71a06f1034b91e15d3ba6b5539c7d3a2d7f13030.tar.bz2 linux-stable-71a06f1034b91e15d3ba6b5539c7d3a2d7f13030.zip | |
mac802154: Fix possible double free upon parsing error
Commit 4d1c7d87030b ("mac802154: Move an skb free within the rx path")
tried to simplify error handling within the receive path by moving the
kfree_skb() call at the very end of the top-level function but missed
one kfree_skb() called upon frame parsing error. Prevent this possible
double free from happening.
Fixes: 4d1c7d87030b ("mac802154: Move an skb free within the rx path")
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20221216235742.646134-1-miquel.raynal@bootlin.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
| -rw-r--r-- | net/mac802154/rx.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c index c2aae2a6d6a6..97bb4401dd3e 100644 --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -213,7 +213,6 @@ __ieee802154_rx_handle_packet(struct ieee802154_local *local, ret = ieee802154_parse_frame_start(skb, &hdr); if (ret) { pr_debug("got invalid frame\n"); - kfree_skb(skb); return; } |