| Message ID | 20210301133241.1277164-1-linus.walleij@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | [net,1/3] net: dsa: rtl4_a: Pad using __skb_put_padto() | expand |
On 3/1/2021 5:32 AM, Linus Walleij wrote: > The eth_skb_pad() function will cause a double free > on failure since dsa_slave_xmit() will try to free > the frame if we return NULL. Fix this by using > __skb_put_padto() instead. > > Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags") > Reported-by: DENG Qingfang <dqfext@gmail.com> > Cc: Mauri Sandberg <sandberg@mailfence.com> > Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c index c17d39b4a1a0..804d756dd80a 100644 --- a/net/dsa/tag_rtl4_a.c +++ b/net/dsa/tag_rtl4_a.c @@ -40,7 +40,7 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb, u16 out; /* Pad out to at least 60 bytes */ - if (unlikely(eth_skb_pad(skb))) + if (__skb_put_padto(skb, ETH_ZLEN, false)) return NULL; if (skb_cow_head(skb, RTL4_A_HDR_LEN) < 0) return NULL;
The eth_skb_pad() function will cause a double free on failure since dsa_slave_xmit() will try to free the frame if we return NULL. Fix this by using __skb_put_padto() instead. Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags") Reported-by: DENG Qingfang <dqfext@gmail.com> Cc: Mauri Sandberg <sandberg@mailfence.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org> --- net/dsa/tag_rtl4_a.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.29.2