diff mbox

[1/2] batman-adv: the skb has not to be freed in recv_roam_adv()

Message ID 1308177145-21191-1-git-send-email-ordex@autistici.org
State Accepted, archived
Commit ad0432c68c59f0fb3cd22279fd8be5aaf1472ac1
Headers show

Commit Message

Antonio Quartulli June 15, 2011, 10:32 p.m. UTC 
In recv_roam_adv(), in case of error the skb is freed and then
NET_RX_DROP is returned. This makes the caller function wrongly invoke
kfree_skb() again. To avoid this double free recv_tt_query() has to
always return NET_RX_DROP and not to free the skb.

Signed-off-by: Antonio Quartulli <ordex@autistici.org>
---
 routing.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)

Comments

Marek Lindner June 16, 2011, 10:16 a.m. UTC | #1 
On Thursday, June 16, 2011 12:32:24 AM Antonio Quartulli wrote:
> In recv_roam_adv(), in case of error the skb is freed and then
> NET_RX_DROP is returned. This makes the caller function wrongly invoke
> kfree_skb() again. To avoid this double free recv_tt_query() has to
> always return NET_RX_DROP and not to free the skb.

Applied in revision ad0432c.

Thanks,
Marek
diff mbox

Patch

diff --git a/routing.c b/routing.c
index 2222288..0ce090c 100644
--- a/routing.c
+++ b/routing.c
@@ -1259,7 +1259,6 @@  int recv_roam_adv(struct sk_buff *skb, struct hard_iface *recv_if)
 	struct roam_adv_packet *roam_adv_packet;
 	struct orig_node *orig_node;
 	struct ethhdr *ethhdr;
-	int ret = NET_RX_DROP;
 
 	/* drop packet if it has not necessary minimum size */
 	if (unlikely(!pskb_may_pull(skb, sizeof(struct roam_adv_packet))))
@@ -1297,10 +1296,9 @@  int recv_roam_adv(struct sk_buff *skb, struct hard_iface *recv_if)
 	bat_priv->tt_poss_change = true;
 
 	orig_node_free_ref(orig_node);
-	ret = NET_RX_SUCCESS;
 out:
-	kfree(skb);
-	return ret;
+	/* returning NET_RX_DROP will make the caller function kfree the skb */
+	return NET_RX_DROP;
 }
 
 /* find a suitable router for this originator, and use