diff options
| author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-12-23 21:45:56 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-09 17:38:34 +0100 |
| commit | f404723deb695a00ea2cb7800b2c2135260dfcf8 (patch) | |
| tree | 870d5d76ab4a915e740b2b1ef474f8b299a0f319 | |
| parent | a2ee6fb9c675125f2f29cc95aae95b4489880f57 (diff) | |
| download | linux-rpi3-f404723deb695a00ea2cb7800b2c2135260dfcf8.tar.gz linux-rpi3-f404723deb695a00ea2cb7800b2c2135260dfcf8.tar.bz2 linux-rpi3-f404723deb695a00ea2cb7800b2c2135260dfcf8.zip | |
tipc: fix a double free in tipc_enable_bearer()
[ Upstream commit dc4501ff287547dea7ca10f1c580c741291a8760 ]
bearer_disable() already calls kfree_rcu() to free struct tipc_bearer,
we don't need to call kfree() again.
Fixes: cb30a63384bc ("tipc: refactor function tipc_enable_bearer()")
Reported-by: syzbot+b981acf1fb240c0c128b@syzkaller.appspotmail.com
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/tipc/bearer.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c index 645c16052052..2649a0a0d45e 100644 --- a/net/tipc/bearer.c +++ b/net/tipc/bearer.c @@ -317,7 +317,6 @@ static int tipc_enable_bearer(struct net *net, const char *name, res = tipc_disc_create(net, b, &b->bcast_addr, &skb); if (res) { bearer_disable(net, b); - kfree(b); errstr = "failed to create discoverer"; goto rejected; } |