summaryrefslogtreecommitdiff
path: root/net/sched
diff options
context:
space:
mode:
authorAlaa Hleihel <alaa@mellanox.com>2020-08-19 18:24:10 +0300
committerDavid S. Miller <davem@davemloft.net>2020-08-20 16:39:31 -0700
commiteda814b97dfb8d9f4808eb2f65af9bd3705c4cae (patch)
treecaac1541309a67e607993592661a6ee2838ea7d5 /net/sched
parentab921f3cdbec01c68705a7ade8bec628d541fc2b (diff)
net/sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow
tcf_ct_handle_fragments() shouldn't free the skb when ip_defrag() call fails. Otherwise, we will cause a double-free bug. In such cases, just return the error to the caller. Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") Signed-off-by: Alaa Hleihel <alaa@mellanox.com> Reviewed-by: Roi Dayan <roid@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sched')
-rw-r--r--net/sched/act_ct.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index e6ad42b11835..2c3619165680 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -704,7 +704,7 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
err = ip_defrag(net, skb, user);
local_bh_enable();
if (err && err != -EINPROGRESS)
- goto out_free;
+ return err;
if (!err) {
*defrag = true;