Skip to contentSkip to conversation

6LoWPAN: double free in lowpan_fragment_xmit()

PATCH Superseded Dan Carpenter 3 participants 5 messages Nov 16, 2011

Subsystems (4)
Networking Network drivers Kernel janitors IEEE 802.15.4
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 6LoWPAN: double free in lowpan_fragment_xmit()

dev_queue_xmit() consumes its own skb, so the call to dev_kfree_skb() ieee802154/6lowpan.clowpan_fragment_xmits a double free.

Signed-off-by Dan Carpenter <[email protected]>
net/ieee802154/6lowpan.c +0 -3
index 602f318..e4ecc1e 100644
@@ -980,9 +980,6 @@ lowpan_fragment_xmit(struct sk_buff *skb, u8 *head,
 
 	ret = dev_queue_xmit(frag);
 
-	if (ret < 0)
-		dev_kfree_skb(frag);
-
 	return ret;
 }
author
#1 lore raw
Quoted 2 lines · Dan Carpenter

dev_queue_xmit() consumes its own skb, so the call to dev_kfree_skb() ieee802154/6lowpan.clowpan_fragment_xmits a double free.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Dur... I messed up my commit message right before sending. Will resend.

regards,
dan carpenter

author
#2 lore raw

PATCH v2 1/1 6LoWPAN: double free in lowpan_fragment_xmit()

dev_queue_xmit() consumes its own skb, so the call to dev_kfree_skb() in lowpan_fragment_xmit() is a double free.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: fixed commit message.

net/ieee802154/6lowpan.c +0 -3
index 602f318..e4ecc1e 100644
@@ -980,9 +980,6 @@ lowpan_fragment_xmit(struct sk_buff *skb, u8 *head,
 
 	ret = dev_queue_xmit(frag);
 
-	if (ret < 0)
-		dev_kfree_skb(frag);
-
 	return ret;
 }
Acked-by on v2 1/1
#3 lore raw

2011/11/16 Dan Carpenter <[email protected]>:

Quoted 14 lines

dev_queue_xmit() consumes its own skb, so the call to dev_kfree_skb() in lowpan_fragment_xmit() is a double free.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: fixed commit message.

net/ieee802154/6lowpan.c +0 -0
index 602f318..e4ecc1e 100644

net/ieee802154/6lowpan.c lowpan_fragment_xmit(struct sk_buff *skb, u8 *head, · line 985

Quoted 9 lines
net/ieee802154/6lowpan.c +0 -3
@@ -980,9 +980,6 @@ lowpan_fragment_xmit(struct sk_buff *skb, u8 *head,
 
        ret = dev_queue_xmit(frag);
 
-       if (ret < 0)
-               dev_kfree_skb(frag);
-
        return ret;
  }
Acked-by Alexander Smirnov <[email protected]>

--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html