Hello Miquel Raynal,
The patch 4d1c7d87030b: "mac802154: Move an skb free within the rx
path" from Oct 26, 2022, leads to the following Smatch static checker
warning:
net/mac802154/rx.c:307 ieee802154_rx()
warn: 'skb' was already freed.
net/mac802154/rx.c
271 void ieee802154_rx(struct ieee802154_local *local, struct sk_buff *skb)
272 {
273 u16 crc;
274
275 WARN_ON_ONCE(softirq_count() == 0);
276
277 if (local->suspended)
278 goto free_skb;
279
280 /* TODO: When a transceiver omits the checksum here, we
281 * add an own calculated one. This is currently an ugly
282 * solution because the monitor needs a crc here.
283 */
284 if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) {
285 crc = crc_ccitt(0, skb->data, skb->len);
286 put_unaligned_le16(crc, skb_put(skb, 2));
287 }
288
289 rcu_read_lock();
290
291 ieee802154_monitors_rx(local, skb);
292
293 /* Level 1 filtering: Check the FCS by software when relevant */
294 if (local->hw.phy->filtering == IEEE802154_FILTERING_NONE) {
295 crc = crc_ccitt(0, skb->data, skb->len);
296 if (crc)
297 goto drop;
298 }
299 /* remove crc */
300 skb_trim(skb, skb->len - 2);
301
302 __ieee802154_rx_handle_packet(local, skb);
This frees skb.
303
304 drop:
305 rcu_read_unlock();
306 free_skb:
--> 307 kfree_skb(skb);
Double free.
308 }
regards,
dan carpenter
