From patchwork Sat Sep 4 22:44:30 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 361 Return-Path: Received: from mail.gmx.net (mailout-de.gmx.net [213.165.64.22]) by open-mesh.net (Postfix) with SMTP id 23330154529 for ; Sun, 5 Sep 2010 00:44:26 +0200 (CEST) Received: (qmail invoked by alias); 04 Sep 2010 22:44:24 -0000 Received: from i59F6A2A6.versanet.de (EHLO sven-desktop.lazhur.ath.cx) [89.246.162.166] by mail.gmx.net (mp008) with SMTP; 05 Sep 2010 00:44:24 +0200 X-Authenticated: #15668376 X-Provags-ID: V01U2FsdGVkX1/NnXInRxzNTdGxdtwskuRvojfs8ms5He45T7pwwt ZmI0xD2a7R3hVY From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sun, 5 Sep 2010 00:44:30 +0200 Message-Id: <1283640270-30498-1-git-send-email-sven.eckelmann@gmx.de> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1283639100-6506-1-git-send-email-sven.eckelmann@gmx.de> References: <1283639100-6506-1-git-send-email-sven.eckelmann@gmx.de> X-Y-GMX-Trusted: 0 Subject: [B.A.T.M.A.N.] [PATCHv2] batman-adv: Don't double free unicast skb on failure X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.11 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Sep 2010 22:44:27 -0000 The soft-interface transmission function expects that the unicast skb is still available when a send failed. This is not true on failed search for a router. Thus we would try to free the skb twice and create many different and hard to debug memory access failures due to access on not (anymore) allocated memory. Reported-by: Andreas Langer Signed-off-by: Sven Eckelmann --- I decided that it makes more sense that the called function frees the data. This makes it similar to dev_queue_xmit or our send_skb_packet. This also fixes the problem with fragmented unicast packets soft-interface.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/soft-interface.c b/soft-interface.c index 38134ae..47e5ada 100644 --- a/soft-interface.c +++ b/soft-interface.c @@ -182,7 +182,7 @@ int interface_tx(struct sk_buff *skb, struct net_device *soft_iface) } else { ret = unicast_send_skb(skb, bat_priv); if (ret != 0) - goto dropped; + goto dropped_freed; } bat_priv->stats.tx_packets++; @@ -190,8 +190,9 @@ int interface_tx(struct sk_buff *skb, struct net_device *soft_iface) goto end; dropped: - bat_priv->stats.tx_dropped++; kfree_skb(skb); +dropped_freed: + bat_priv->stats.tx_dropped++; end: return NETDEV_TX_OK; }