net: fix double skb free in dcbnl

netlink_unicast() calls kfree_skb even in the error case.

dcbnl calls netlink_unicast() which when it fails free's the
skb and returns an error value.  dcbnl is free'ing the skb
again when this error occurs.  This patch removes the double
free.

Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index e0879bfb7dd56dc6857ea16aacb82f258df61e18..ac1205df6c86327155d79f81da345e8b8411bec7 100644 (file)
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -194,7 +194,7 @@ static int dcbnl_reply(u8 value, u8 event, u8 cmd, u8 attr, u32 pid,
        nlmsg_end(dcbnl_skb, nlh);
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
        nlmsg_end(dcbnl_skb, nlh);
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)

-               goto err;
+               return -EINVAL;

 
        return 0;
 nlmsg_failure:
 
        return 0;
 nlmsg_failure:


@@ -275,7 +275,7 @@ static int dcbnl_getpfccfg(struct net_device *netdev, struct nlattr **tb,
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)

-               goto err;
+               goto err_out;

 
        return 0;
 nlmsg_failure:
 
        return 0;
 nlmsg_failure:


@@ -316,12 +316,11 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)

-               goto err;
+               goto err_out;

 
        return 0;
 
 nlmsg_failure:
 
        return 0;
 
 nlmsg_failure:

-err:

        kfree_skb(dcbnl_skb);
 err_out:
        return -EINVAL;
        kfree_skb(dcbnl_skb);
 err_out:
        return -EINVAL;


@@ -383,7 +382,7 @@ static int dcbnl_getcap(struct net_device *netdev, struct nlattr **tb,
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)

-               goto err;
+               goto err_out;

 
        return 0;
 nlmsg_failure:
 
        return 0;
 nlmsg_failure:


@@ -460,7 +459,7 @@ static int dcbnl_getnumtcs(struct net_device *netdev, struct nlattr **tb,
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret) {
                ret = -EINVAL;
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret) {
                ret = -EINVAL;

-               goto err;
+               goto err_out;

        }
 
        return 0;
        }
 
        return 0;


@@ -799,7 +798,7 @@ static int __dcbnl_pg_getcfg(struct net_device *netdev, struct nlattr **tb,
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)

-               goto err;
+               goto err_out;

 
        return 0;
 
 
        return 0;
 


@@ -1063,7 +1062,7 @@ static int dcbnl_bcn_getcfg(struct net_device *netdev, struct nlattr **tb,
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)
 
        ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
        if (ret)

-               goto err;
+               goto err_out;

 
        return 0;
 
 
        return 0;