| Message ID | 20210301133241.1277164-1-linus.walleij@linaro.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/3] net: dsa: rtl4_a: Pad using __skb_put_padto() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | warning | Series does not have a cover letter |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/cc_maintainers | success | CCed 8 of 8 maintainers |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 2 this patch: 2 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 8 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 2 this patch: 2 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
On 3/1/2021 5:32 AM, Linus Walleij wrote: > The eth_skb_pad() function will cause a double free > on failure since dsa_slave_xmit() will try to free > the frame if we return NULL. Fix this by using > __skb_put_padto() instead. > > Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags") > Reported-by: DENG Qingfang <dqfext@gmail.com> > Cc: Mauri Sandberg <sandberg@mailfence.com> > Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c index c17d39b4a1a0..804d756dd80a 100644 --- a/net/dsa/tag_rtl4_a.c +++ b/net/dsa/tag_rtl4_a.c @@ -40,7 +40,7 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb, u16 out; /* Pad out to at least 60 bytes */ - if (unlikely(eth_skb_pad(skb))) + if (__skb_put_padto(skb, ETH_ZLEN, false)) return NULL; if (skb_cow_head(skb, RTL4_A_HDR_LEN) < 0) return NULL;
The eth_skb_pad() function will cause a double free on failure since dsa_slave_xmit() will try to free the frame if we return NULL. Fix this by using __skb_put_padto() instead. Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags") Reported-by: DENG Qingfang <dqfext@gmail.com> Cc: Mauri Sandberg <sandberg@mailfence.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> --- net/dsa/tag_rtl4_a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)