Commit d10a26aa authored by Martin Schiller's avatar Martin Schiller Committed by Paolo Abeni
Browse files

net/x25: Fix potential double free of skb 



When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
line 48 and returns 1 (error).
This error propagates back through the call chain:

x25_queue_rx_frame returns 1
    |
    v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
    |
    v
x25_process_rx_frame returns queued=0
    |
    v
x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
again

This would free the same skb twice. Looking at x25_backlog_rcv:

net/x25/x25_in.c:x25_backlog_rcv() {
    ...
    queued = x25_process_rx_frame(sk, skb);
    ...
    if (!queued)
        kfree_skb(skb);
}

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarMartin Schiller <ms@dev.tdt.de>
Link: https://patch.msgid.link/20260331-x25_fraglen-v4-1-3e69f18464b4@dev.tdt.de


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 9351edf6

net/x25/x25_in.c

+2 −3
Original line number Diff line number Diff line
@@ -44,10 +44,9 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more) 
	if (x25->fraglen > 0) {	/* End of fragment */

		int len = x25->fraglen + skb->len;



		if ((skbn = alloc_skb(len, GFP_ATOMIC)) == NULL){

			kfree_skb(skb);

		skbn = alloc_skb(len, GFP_ATOMIC);

		if (!skbn)

			return 1;

		}



		skb_queue_tail(&x25->fragment_queue, skb);