Re: [PATCH] netrom: fix double-free in nr_route_frame()
From: patchwork-bot+netdevbpf
Date: Tue Jan 20 2026 - 22:30:32 EST
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:
On Mon, 19 Jan 2026 15:33:59 +0900 you wrote:
> In nr_route_frame(), old_skb is immediately freed without checking if
> nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,
> the caller function will free old_skb again, causing a double-free bug.
>
> Therefore, to prevent this, we need to modify it to check whether
> nr_neigh->ax25 is NULL before freeing old_skb.
>
> [...]
Here is the summary with links:
- netrom: fix double-free in nr_route_frame()
https://git.kernel.org/netdev/net/c/ba1096c31528
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html