Commit 684ba26a authored by Wang Hai's avatar Wang Hai Committed by Dong Chenchen
Browse files

net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() 

stable inclusion
from stable-v4.19.323
commit 137010d26dc5cd47cd62fef77cbe952d31951b7a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SUF
CVE: CVE-2024-50168

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=137010d26dc5cd47cd62fef77cbe952d31951b7a



--------------------------------

[ Upstream commit 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8 ]

The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb
in case of skb->len being too long, add dev_kfree_skb() to fix it.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Message-ID: <20241015144148.7918-1-wanghai38@huawei.com>
Signed-off-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent faa52e40

drivers/net/ethernet/i825xx/sun3_82586.c

+1 −0
Original line number Diff line number Diff line
@@ -1015,6 +1015,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev) 
	if(skb->len > XMIT_BUFF_SIZE)

	{

		printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len);

		dev_kfree_skb(skb);

		return NETDEV_TX_OK;

	}