lkml.org 
[lkml]   [2006]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] ISDN: fix double free bug in isdn_net
Date
There's double-free bug in 
drivers/isdn/i4l/isdn_net.c::isdn_net_writebuf_skb().

If isdn_writebuf_skb_stub() doesn't handle the entire skb, then it will
have freed the skb that was passed to it and when the code then jumps
to the error label it'll result in a double free of the skb.

The easy way to fix this is to insert an assignment of skb = NULL in the
'if' following the call to isdn_writebuf_skb_stub() so that when the code
at the error label calls dev_kfree_skb(skb); the skb will be NULL and
nothing will happen since dev_kfree_skb() just does a return if passed a
NULL.


Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
---

drivers/isdn/i4l/isdn_net.c | 1 +
1 files changed, 1 insertion(+)

--- linux-2.6.18-rc4-orig/drivers/isdn/i4l/isdn_net.c 2006-08-11 00:10:55.000000000 +0200
+++ linux-2.6.18-rc4/drivers/isdn/i4l/isdn_net.c 2006-08-12 22:39:56.000000000 +0200
@@ -1023,6 +1023,7 @@ void isdn_net_writebuf_skb(isdn_net_loca
if (ret != len) {
/* we should never get here */
printk(KERN_WARNING "%s: HL driver queue full\n", lp->name);
+ skb = NULL;
goto error;
}


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-08-12 22:49    [W:1.141 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site