tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net-shapers: don't free reply skb after genlmsg_reply()

genlmsg_reply() hands the reply skb to netlink, and
netlink_unicast() consumes it on all return paths, whether the
skb is queued successfully or freed on an error path.

net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit()
currently jump to free_msg after genlmsg_reply() fails and call
nlmsg_free(msg), which can hit the same skb twice.

Return the genlmsg_reply() error directly and keep free_msg
only for pre-reply failures.

Fixes: 4b623f9f0f59 ("net-shapers: implement NL get operation")
Fixes: 553ea9f1efd6 ("net: shaper: implement introspection support")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
Link: https://patch.msgid.link/20260309173450.538026-2-p@1g4.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Paul Moses and committed by
Jakub Kicinski 57885276 f441b489

+2 -9
+2 -9
net/shaper/shaper.c
··· 759 759 if (ret) 760 760 goto free_msg; 761 761 762 - ret = genlmsg_reply(msg, info); 763 - if (ret) 764 - goto free_msg; 765 - 766 - return 0; 762 + return genlmsg_reply(msg, info); 767 763 768 764 free_msg: 769 765 nlmsg_free(msg); ··· 1309 1313 if (ret) 1310 1314 goto free_msg; 1311 1315 1312 - ret = genlmsg_reply(msg, info); 1313 - if (ret) 1314 - goto free_msg; 1315 - return 0; 1316 + return genlmsg_reply(msg, info); 1316 1317 1317 1318 free_msg: 1318 1319 nlmsg_free(msg);