Author: marek Date: 2010-09-05 00:56:50 +0200 (Sun, 05 Sep 2010) New Revision: 1786
Modified: trunk/batman-adv/soft-interface.c Log: batman-adv: Don't double free unicast skb on failure
The soft-interface transmission function expects that the unicast skb is still available when a send failed. This is not true on failed search for a router. Thus we would try to free the skb twice and create many different and hard to debug memory access failures due to access on not (anymore) allocated memory.
Reported-by: Andreas Langer an.langer@gmx.de Signed-off-by: Sven Eckelmann sven.eckelmann@gmx.de
Modified: trunk/batman-adv/soft-interface.c =================================================================== --- trunk/batman-adv/soft-interface.c 2010-09-04 22:37:10 UTC (rev 1785) +++ trunk/batman-adv/soft-interface.c 2010-09-04 22:56:50 UTC (rev 1786) @@ -183,7 +183,7 @@ } else { ret = unicast_send_skb(skb, bat_priv); if (ret != 0) - goto dropped; + goto dropped_freed; }
bat_priv->stats.tx_packets++; @@ -191,8 +191,9 @@ goto end;
dropped: + kfree_skb(skb); +dropped_freed: bat_priv->stats.tx_dropped++; - kfree_skb(skb); end: return NETDEV_TX_OK; }