On Fri, 2023-10-27 at 15:19 +0300, Dan Carpenter wrote:
> The prp_fill_rct() function can fail. In that situation, it frees the
> skb and returns NULL. Meanwhile on the success path, it returns the
> original skb. So it's straight forward to fix bug by using the returned
> value.
>
> Fixes: 451d8123f897 ("net: prp: add packet handling support")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
> net/hsr/hsr_forward.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
> index b71dab630a87..80cdc6f6b34c 100644
> --- a/net/hsr/hsr_forward.c
> +++ b/net/hsr/hsr_forward.c
> @@ -342,9 +342,7 @@ struct sk_buff *prp_create_tagged_frame(struct hsr_frame_info *frame,
> skb = skb_copy_expand(frame->skb_std, 0,
> skb_tailroom(frame->skb_std) + HSR_HLEN,
> GFP_ATOMIC);
> - prp_fill_rct(skb, frame, port);
> -
> - return skb;
> + return prp_fill_rct(skb, frame, port);
> }
>
> static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx>
(note both trees are currently locked now due to the pending PR; this
tag is intended to speed-up the merge after the PR itself)
