Re: [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Subject: Re: [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()
From: Alexander Aring <aahringo@xxxxxxxxxx>
Date: Thu, 5 Oct 2023 18:10:13 -0400
Cc: Alexander Aring <alex.aring@xxxxxxxxx>, Stefan Schmidt <stefan@xxxxxxxxxxxxxxxxxx>, Miquel Raynal <miquel.raynal@xxxxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>, Eric Dumazet <edumazet@xxxxxxxxxx>, Jakub Kicinski <kuba@xxxxxxxxxx>, Paolo Abeni <pabeni@xxxxxxxxxx>, Angus Chen <angus.chen@xxxxxxxxxxxxxxx>, Luis Chamberlain <mcgrof@xxxxxxxxxx>, Joel Granados <joel.granados@xxxxxxxxx>, linux-wpan@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxxxxxx, kernel-janitors@xxxxxxxxxxxxxxx
In-reply-to: <3c91e145-5cd5-4d9d-9590-3b74b811436a@moroto.mountain>
References: <3c91e145-5cd5-4d9d-9590-3b74b811436a@moroto.mountain>

Hi,

On Wed, Oct 4, 2023 at 5:22 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> The skb() is freed by the caller in lowpan_invoke_rx_handlers() so this
> free is a double free.
>

lowpan_frag_rcv() does not call lowpan_invoke_rx_handlers(), it calls
lowpan_invoke_frag_rx_handlers(), or is there something I overlooked
here?

- Alex

Follow-Ups:
- Re: [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()
  - From: Dan Carpenter

References:
- [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()
  - From: Dan Carpenter

Prev by Date: Re: [PATCH] dax: remove unnecessary check
Next by Date: Re: [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()
Previous by thread: [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()
Next by thread: Re: [PATCH net] 6lowpan: fix double free in lowpan_frag_rcv()
Index(es):
- Date
- Thread

[Index of Archives] [Kernel Development] [Kernel Announce] [Kernel Newbies] [Linux Networking Development] [Share Photos] [IDE] [Security] [Git] [Netfilter] [Yosemite News] [MIPS Linux] [ARM Linux] [Device Mapper]