tipc: Fix kfree_skb() of uninitialised pointer (regression in 4.3.3)
This commit is contained in:
parent
9a894164f8
commit
ca0bbf698b
|
@ -76,6 +76,7 @@ linux (4.3.3-1) UNRELEASED; urgency=medium
|
||||||
register_netdevice failure" in 4.3.3
|
register_netdevice failure" in 4.3.3
|
||||||
* net: Ignore ABI changes due to "ipv6: add complete rcu protection around
|
* net: Ignore ABI changes due to "ipv6: add complete rcu protection around
|
||||||
np->opt", which don't appear to affect out-of-tree modules
|
np->opt", which don't appear to affect out-of-tree modules
|
||||||
|
* tipc: Fix kfree_skb() of uninitialised pointer (regression in 4.3.3)
|
||||||
|
|
||||||
-- Ben Hutchings <ben@decadent.org.uk> Mon, 14 Dec 2015 20:59:37 +0000
|
-- Ben Hutchings <ben@decadent.org.uk> Mon, 14 Dec 2015 20:59:37 +0000
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,29 @@
|
||||||
|
Date: Tue, 15 Dec 2015 21:21:56 +0000
|
||||||
|
From: Ben Hutchings <ben@decadent.org.uk>
|
||||||
|
Subject: tipc: Fix kfree_skb() of uninitialised pointer
|
||||||
|
Forwarded: http://mid.gmane.org/20151215212156.GQ28542@decadent.org.uk
|
||||||
|
|
||||||
|
Commit 7098356baca7 ("tipc: fix error handling of expanding buffer
|
||||||
|
headroom") added a "goto tx_error". This is fine upstream, but
|
||||||
|
when backported to 4.3 it results in attempting to free the clone
|
||||||
|
before it has been allocated. In this early error case, no
|
||||||
|
cleanup is needed.
|
||||||
|
|
||||||
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||||
|
---
|
||||||
|
net/tipc/udp_media.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
|
||||||
|
index 86f2e7c..73bdf1b 100644
|
||||||
|
--- a/net/tipc/udp_media.c
|
||||||
|
+++ b/net/tipc/udp_media.c
|
||||||
|
@@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
|
||||||
|
if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
|
||||||
|
err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
|
||||||
|
if (err)
|
||||||
|
- goto tx_error;
|
||||||
|
+ return err;
|
||||||
|
}
|
||||||
|
|
||||||
|
clone = skb_clone(skb, GFP_ATOMIC);
|
|
@ -103,3 +103,4 @@ features/arm/arm-dts-split-audio-configuration-to-separate-exynos.patch
|
||||||
features/arm/arm-dts-add-support-odroid-xu4-board-for-exynos5422-.patch
|
features/arm/arm-dts-add-support-odroid-xu4-board-for-exynos5422-.patch
|
||||||
bugfix/all/revert-vrf-fix-double-free-and-memory-corruption-on-.patch
|
bugfix/all/revert-vrf-fix-double-free-and-memory-corruption-on-.patch
|
||||||
bugfix/all/vrf-fix-double-free-and-memory-corruption-on-registe.patch
|
bugfix/all/vrf-fix-double-free-and-memory-corruption-on-registe.patch
|
||||||
|
bugfix/all/tipc-fix-kfree_skb-of-uninitialised-pointer.patch
|
||||||
|
|
Loading…
Reference in New Issue