From patchwork Fri Aug 25 08:24:28 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 805805 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xdvbx45t2z9sRW for ; Fri, 25 Aug 2017 18:34:53 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932170AbdHYId5 (ORCPT ); Fri, 25 Aug 2017 04:33:57 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:29060 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932162AbdHYIdw (ORCPT ); Fri, 25 Aug 2017 04:33:52 -0400 Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v7P8Xlc8025104 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 25 Aug 2017 08:33:48 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v7P8XlBX004357 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 25 Aug 2017 08:33:47 GMT Received: from abhmp0002.oracle.com (abhmp0002.oracle.com [141.146.116.8]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v7P8Xli5019315; Fri, 25 Aug 2017 08:33:47 GMT Received: from mwanda (/41.202.241.62) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 25 Aug 2017 01:33:05 -0700 Date: Fri, 25 Aug 2017 11:24:28 +0300 From: Dan Carpenter To: Aviad Krawczyk Cc: netdev@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] hinic: skb_pad() frees on error Message-ID: <20170825082428.hpnbs4i74bubm4cz@mwanda> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding User-Agent: NeoMutt/20170609 (1.8.3) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The skb_pad() function frees the skb on error, so this code has a double free. Fixes: 00e57a6d4ad3 ("net-next/hinic: Add Tx operation") Signed-off-by: Dan Carpenter diff --git a/drivers/net/ethernet/huawei/hinic/hinic_tx.c b/drivers/net/ethernet/huawei/hinic/hinic_tx.c index 5bf6a32faa46..abe3e38cd342 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_tx.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_tx.c @@ -192,7 +192,7 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) if (skb->len < MIN_SKB_LEN) { if (skb_pad(skb, MIN_SKB_LEN - skb->len)) { netdev_err(netdev, "Failed to pad skb\n"); - goto skb_error; + goto update_error_stats; } skb->len = MIN_SKB_LEN; @@ -237,6 +237,7 @@ netdev_tx_t hinic_xmit_frame(struct sk_buff *skb, struct net_device *netdev) skb_error: dev_kfree_skb_any(skb); +update_error_stats: u64_stats_update_begin(&txq->txq_stats.syncp); txq->txq_stats.tx_dropped++; u64_stats_update_end(&txq->txq_stats.syncp);