forked from luck/tmp_suning_uos_patched
devlink: double free in devlink_resource_fill()
Smatch reports that devlink_dpipe_send_and_alloc_skb() frees the skb on error so this is a double free. We fixed a bunch of these bugs in commit7fe4d6dcbc
("devlink: Remove redundant free on error path") but we accidentally overlooked this one. Fixes:d9f9b9a4d0
("devlink: Add support for resource abstraction") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
e6ce3822a9
commit
83fe9a9661
|
@ -2592,7 +2592,7 @@ static int devlink_resource_fill(struct genl_info *info,
|
|||
if (!nlh) {
|
||||
err = devlink_dpipe_send_and_alloc_skb(&skb, info);
|
||||
if (err)
|
||||
goto err_skb_send_alloc;
|
||||
return err;
|
||||
goto send_done;
|
||||
}
|
||||
return genlmsg_reply(skb, info);
|
||||
|
@ -2600,7 +2600,6 @@ static int devlink_resource_fill(struct genl_info *info,
|
|||
nla_put_failure:
|
||||
err = -EMSGSIZE;
|
||||
err_resource_put:
|
||||
err_skb_send_alloc:
|
||||
nlmsg_free(skb);
|
||||
return err;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user