diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-05-02 21:05:13 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-05-02 21:06:25 +0200 |
| commit | e958da0ddbe831197a0023251880a4a09d5ba268 (patch) | |
| tree | eacded26f9563064a44fd1afe730493898adadb9 /net/tipc | |
| parent | Merge branch 'bnxt_en-updates-for-net-next' (diff) | |
| parent | Merge tag 'net-6.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netd... (diff) | |
| download | linux-e958da0ddbe831197a0023251880a4a09d5ba268.tar.xz linux-e958da0ddbe831197a0023251880a4a09d5ba268.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR.
Conflicts:
include/linux/filter.h
kernel/bpf/core.c
66e13b615a0c ("bpf: verifier: prevent userspace memory access")
d503a04f8bc0 ("bpf: Add support for certain atomics in bpf_arena to x86 JIT")
https://lore.kernel.org/all/20240429114939.210328b0@canb.auug.org.au/
No adjacent changes.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/tipc')
| -rw-r--r-- | net/tipc/msg.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 5c9fd4791c4b..76284fc538eb 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -142,9 +142,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - *buf = NULL; if (skb_has_frag_list(frag) && __skb_linearize(frag)) goto err; + *buf = NULL; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; @@ -156,6 +156,11 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (!head) goto err; + /* Either the input skb ownership is transferred to headskb + * or the input skb is freed, clear the reference to avoid + * bad access on error path. + */ + *buf = NULL; if (skb_try_coalesce(head, frag, &headstolen, &delta)) { kfree_skb_partial(frag, headstolen); } else { @@ -179,7 +184,6 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) *headbuf = NULL; return 1; } - *buf = NULL; return 0; err: kfree_skb(*buf); |