Re: [net] net: fix double free issue of skbuff

2016-02-29 Thread David Miller
From: 张胜举 Date: Mon, 29 Feb 2016 22:16:37 +0800 >> On Mon, 2016-02-29 at 12:22 +, Zhang Shengju wrote: >> > If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. >> > Then at skb_vlan_untag(), it will free skbuff again which cause double >> > free. >> >> On skb_reorder_vlan

Re: [net] net: fix double free issue of skbuff

2016-02-29 Thread David Miller
From: Zhang Shengju Date: Mon, 29 Feb 2016 12:22:53 + > If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. > Then at skb_vlan_untag(), it will free skbuff again which cause double > free. The 'skb' local variable in this case will be set to "NULL", calling kfree_skb() on

Re: [net] net: fix double free issue of skbuff

2016-02-29 Thread 张胜举
> On Mon, 2016-02-29 at 12:22 +, Zhang Shengju wrote: > > If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. > > Then at skb_vlan_untag(), it will free skbuff again which cause double > > free. > > On skb_reorder_vlan_header() failure, skb_vlan_untag() will call > kfree_sk

Re: [net] net: fix double free issue of skbuff

2016-02-29 Thread 张胜举
> Hello. > > On 2/29/2016 3:22 PM, Zhang Shengju wrote: > > > If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. > > Then at skb_vlan_untag(), it will free skbuff again which cause double > > free. > > > > This patch removes kfree_skb() call in function > skb_reorder_vlan_hea

Re: [net] net: fix double free issue of skbuff

2016-02-29 Thread Paolo Abeni
On Mon, 2016-02-29 at 12:22 +, Zhang Shengju wrote: > If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. > Then at skb_vlan_untag(), it will free skbuff again which cause double > free. On skb_reorder_vlan_header() failure, skb_vlan_untag() will call kfree_skb() using the

Re: [net] net: fix double free issue of skbuff

2016-02-29 Thread Sergei Shtylyov
Hello. On 2/29/2016 3:22 PM, Zhang Shengju wrote: If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. Then at skb_vlan_untag(), it will free skbuff again which cause double free. This patch removes kfree_skb() call in function skb_reorder_vlan_header(). Signed-off-by: Zhan

[net] net: fix double free issue of skbuff

2016-02-29 Thread Zhang Shengju
If skb_reorder_vlan_header() failed, skb is freed and NULL is returned. Then at skb_vlan_untag(), it will free skbuff again which cause double free. This patch removes kfree_skb() call in function skb_reorder_vlan_header(). Signed-off-by: Zhang Shengju --- net/core/skbuff.c | 1 - 1 file change