HSI: ssi_protocol: double free in ssip_pn_xmit()
[ Upstream commit3026050179
] If skb_pad() fails then it frees skb and we don't need to free it again at the end of the function. Fixes:dc7bf5d7
("HSI: Introduce driver for SSI Protocol") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8716c87ec2
commit
fd63c2b253
|
@ -976,7 +976,7 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
goto drop;
|
||||
/* Pad to 32-bits - FIXME: Revisit*/
|
||||
if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3)))
|
||||
goto drop;
|
||||
goto inc_dropped;
|
||||
|
||||
/*
|
||||
* Modem sends Phonet messages over SSI with its own endianess...
|
||||
|
@ -1028,8 +1028,9 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev)
|
|||
drop2:
|
||||
hsi_free_msg(msg);
|
||||
drop:
|
||||
dev->stats.tx_dropped++;
|
||||
dev_kfree_skb(skb);
|
||||
inc_dropped:
|
||||
dev->stats.tx_dropped++;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue