diff options
| author | Nikita Yushchenko <[email protected]> | 2024-12-08 09:50:03 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2024-12-11 03:02:47 +0000 |
| commit | bb617328bafa1023d8e9c25a25345a564c66c14f (patch) | |
| tree | ccb0a2bcdf7b3d8b096ac38994f32ee8e8eba986 /net/unix/af_unix.c | |
| parent | net: renesas: rswitch: fix race window between tx start and complete (diff) | |
| download | kernel-bb617328bafa1023d8e9c25a25345a564c66c14f.tar.gz kernel-bb617328bafa1023d8e9c25a25345a564c66c14f.zip | |
net: renesas: rswitch: fix leaked pointer on error path
If error path is taken while filling descriptor for a frame, skb
pointer is left in the entry. Later, on the ring entry reuse, the
same entry could be used as a part of a multi-descriptor frame,
and skb for that new frame could be stored in a different entry.
Then, the stale pointer will reach the completion routine, and passed
to the release operation.
Fix that by clearing the saved skb pointer at the error path.
Fixes: d2c96b9d5f83 ("net: rswitch: Add jumbo frames handling for TX")
Signed-off-by: Nikita Yushchenko <[email protected]>
Reviewed-by: Yoshihiro Shimoda <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions
