Re: Re: [PATCH] ethernet/realtek/r8169: Fix a double free in rtl8169_start_xmit

2021-03-29 Thread lyl2019
> -原始邮件- > 发件人: "Heiner Kallweit" > 发送时间: 2021-03-29 17:51:30 (星期一) > 收件人: "Lv Yunlong" , nic_s...@realtek.com, > k...@kernel.org > 抄送: net...@vger.kernel.org, linux-kernel@vger.kernel.org > 主题: Re: [PATCH] ethernet/realtek/r8169: F

Re: [PATCH] ethernet/realtek/r8169: Fix a double free in rtl8169_start_xmit

2021-03-29 Thread Heiner Kallweit
On 29.03.2021 11:02, Lv Yunlong wrote: > In rtl8169_start_xmit, it calls rtl8169_tso_csum_v2(tp, skb, opts) and > rtl8169_tso_csum_v2() calls __skb_put_padto(skb, padto, false). If > __skb_put_padto() failed, it will free the skb in the first time and > return error. Then rtl8169_start_xmit will

[PATCH] ethernet/realtek/r8169: Fix a double free in rtl8169_start_xmit

2021-03-29 Thread Lv Yunlong
In rtl8169_start_xmit, it calls rtl8169_tso_csum_v2(tp, skb, opts) and rtl8169_tso_csum_v2() calls __skb_put_padto(skb, padto, false). If __skb_put_padto() failed, it will free the skb in the first time and return error. Then rtl8169_start_xmit will goto err_dma_0. But in err_dma_0 label, the skb