The backported version of commit 7f109f7cc371 ("vrf: fix double free
and memory corruption on register_netdevice failure") incorrectly
removed a kfree() from the failure path as well as the free_netdev().
Add that back.

Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
---
 drivers/net/vrf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index c9e309c..6c25fd0 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -581,6 +581,7 @@ static int vrf_newlink(struct net *src_net, struct 
net_device *dev,
 {
        struct net_vrf *vrf = netdev_priv(dev);
        struct net_vrf_dev *vrf_ptr;
+       int err;
 
        if (!data || !data[IFLA_VRF_TABLE])
                return -EINVAL;
@@ -598,7 +599,10 @@ static int vrf_newlink(struct net *src_net, struct 
net_device *dev,
 
        rcu_assign_pointer(dev->vrf_ptr, vrf_ptr);
 
-       return register_netdev(dev);
+       err = register_netdev(dev);
+       if (err)
+               kfree(vrf_ptr);
+       return err;
 }
 
 static size_t vrf_nl_getsize(const struct net_device *dev)

Attachment: signature.asc
Description: Digital signature

Reply via email to