| From foo@baz Thu Mar 22 14:57:32 CET 2018 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Fri, 21 Apr 2017 13:39:09 +0300 |
| Subject: HSI: ssi_protocol: double free in ssip_pn_xmit() |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| |
| [ Upstream commit 3026050179a3a9a6f5c892c414b5e36ecf092081 ] |
| |
| If skb_pad() fails then it frees skb and we don't need to free it again |
| at the end of the function. |
| |
| Fixes: dc7bf5d7 ("HSI: Introduce driver for SSI Protocol") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Sebastian Reichel <sre@kernel.org> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/hsi/clients/ssi_protocol.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/hsi/clients/ssi_protocol.c |
| +++ b/drivers/hsi/clients/ssi_protocol.c |
| @@ -976,7 +976,7 @@ static int ssip_pn_xmit(struct sk_buff * |
| goto drop; |
| /* Pad to 32-bits - FIXME: Revisit*/ |
| if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3))) |
| - goto drop; |
| + goto inc_dropped; |
| |
| /* |
| * Modem sends Phonet messages over SSI with its own endianess... |
| @@ -1028,8 +1028,9 @@ static int ssip_pn_xmit(struct sk_buff * |
| drop2: |
| hsi_free_msg(msg); |
| drop: |
| - dev->stats.tx_dropped++; |
| dev_kfree_skb(skb); |
| +inc_dropped: |
| + dev->stats.tx_dropped++; |
| |
| return 0; |
| } |
