diff options
| author |   Alaa Hleihel <alaa@mellanox.com> | 2020-08-19 18:24:10 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-27 09:30:48 +0200 |
| commit | bfc6e25c15f8575a7122ecdc69dfa953f7853847 (patch) | |
| tree | bbbfdf340fa856f043daa73d0862e9db8265a3f7 | |
| parent | de55a7e72fcab43e7f3efa23049d06706246f485 (diff) | |
| download | linux-yocto-bfc6e25c15f8575a7122ecdc69dfa953f7853847.tar.gz | |
net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
[ Upstream commit eda814b97dfb8d9f4808eb2f65af9bd3705c4cae ]
tcf_ct_handle_fragments() shouldn't free the skb when ip_defrag() call
fails. Otherwise, we will cause a double-free bug.
In such cases, just return the error to the caller.
Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
Signed-off-by: Alaa Hleihel <alaa@mellanox.com>
Reviewed-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/sched/act_ct.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 417526d7741b..16bc5b0d1eaa 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -702,7 +702,7 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, err = ip_defrag(net, skb, user); local_bh_enable(); if (err && err != -EINPROGRESS) - goto out_free; + return err; if (!err) { *defrag = true; |