Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"

Xie He · davem330 · commit d362fd0be456 · 2021-05-03T13:37:58.000-07:00
This reverts commit 1b479fb ("drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"). 1. This commit is incorrect. "__skb_pad" will NOT free the skb on failure when its "free_on_error" parameter is "false". 2. This commit claims to fix my commit. But it didn't CC me?? Fixes: 1b479fb ("drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit") Cc: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Signed-off-by: Xie He <xie.he.0141@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
@@ -415,7 +415,7 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
 
 		if (pad > 0) { /* Pad the frame with zeros */
 			if (__skb_pad(skb, pad, false))
-				goto out;
+				goto drop;
 			skb_put(skb, pad);
 		}
 	}
@@ -448,9 +448,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
 	return NETDEV_TX_OK;
 
 drop:
-	kfree_skb(skb);
-out:
 	dev->stats.tx_dropped++;
+	kfree_skb(skb);
 	return NETDEV_TX_OK;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -415,7 +415,7 @@ static netdev_tx_t pvc_xmit(struct sk_buff skb, struct net_device dev)`
`415`	`415`
`416`	`416`	`if (pad > 0) { /* Pad the frame with zeros */`
`417`	`417`	`if (__skb_pad(skb, pad, false))`
`418`		`- goto out;`
	`418`	`+ goto drop;`
`419`	`419`	`skb_put(skb, pad);`
`420`	`420`	`}`
`421`	`421`	`}`
`@@ -448,9 +448,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff skb, struct net_device dev)`
`448`	`448`	`return NETDEV_TX_OK;`
`449`	`449`
`450`	`450`	`drop:`
`451`		`- kfree_skb(skb);`
`452`		`-out:`
`453`	`451`	`dev->stats.tx_dropped++;`
	`452`	`+ kfree_skb(skb);`
`454`	`453`	`return NETDEV_TX_OK;`
`455`	`454`	`}`
`456`	`455`