diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-06-03 19:25:32 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-06-03 19:25:32 +0000 |
| commit | e8d3ef9fa6e1265bce5992d8f77414220b39d2d9 (patch) | |
| tree | 09bf132380f6d9b925db951e6521776afea25d83 /net/tipc/msg.c | |
| parent | Releasing progress-linux version 5.10.216-1progress6u1. (diff) | |
| download | linux-e8d3ef9fa6e1265bce5992d8f77414220b39d2d9.tar.xz linux-e8d3ef9fa6e1265bce5992d8f77414220b39d2d9.zip | |
Merging upstream version 5.10.218.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'net/tipc/msg.c')
| -rw-r--r-- | net/tipc/msg.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 91dcf648d..1fcd67613 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -148,9 +148,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - *buf = NULL; if (skb_has_frag_list(frag) && __skb_linearize(frag)) goto err; + *buf = NULL; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; @@ -162,6 +162,11 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (!head) goto err; + /* Either the input skb ownership is transferred to headskb + * or the input skb is freed, clear the reference to avoid + * bad access on error path. + */ + *buf = NULL; if (skb_try_coalesce(head, frag, &headstolen, &delta)) { kfree_skb_partial(frag, headstolen); } else { @@ -185,7 +190,6 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) *headbuf = NULL; return 1; } - *buf = NULL; return 0; err: kfree_skb(*buf); |