On Thu, Oct 05, 2023 at 06:10:13PM -0400, Alexander Aring wrote: > Hi, > > On Wed, Oct 4, 2023 at 5:22 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > > > > The skb() is freed by the caller in lowpan_invoke_rx_handlers() so this > > free is a double free. > > > > lowpan_frag_rcv() does not call lowpan_invoke_rx_handlers(), it calls > lowpan_invoke_frag_rx_handlers(), or is there something I overlooked > here? Actually now that I look at it more closely this isn't a bug. The way I was looking at it was that it was the other way around. lowpan_invoke_rx_handlers() is the caller. But actually this returns -1. lowpan_invoke_rx_handlers() will pass the freed skb to lowpan_rx_handlers_result() but the -1 gets translated to RX_DROP in lowpan_rx_h_frag() then it just returns NET_RX_DROP. It's a no-op and not a double free. Sorry! regards, dan carpenter
