Doug / smarc-fsl-linux-kernel

Download as
Browse Code »

Commit ba7605745d5c99f0e71b3ec6c7cb5ed6afe540ad

Authored by Dmitry Tarnyagin
Committed by David S. Miller
1 parent b01377a420
Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga

caif: Bugfix double kfree_skb upon xmit failure 

SKB is freed twice upon send error. The Network stack consumes SKB even
when it returns error code.

Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 6 additions and 4 deletions Side-by-side Diff

net/caif/caif_socket.c
Diff comments   View file @ ba76057
... ... @@ -539,8 +539,10 @@
539 539 pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
540 540 memset(skb->cb, 0, sizeof(struct caif_payload_info));
541 541  
542   - if (cf_sk->layer.dn == NULL)
  542 + if (cf_sk->layer.dn == NULL) {
  543 + kfree_skb(skb);
543 544 return -EINVAL;
  545 + }
544 546  
545 547 return cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
546 548 }
547 549  
... ... @@ -683,10 +685,10 @@
683 685 }
684 686 err = transmit_skb(skb, cf_sk,
685 687 msg->msg_flags&MSG_DONTWAIT, timeo);
686   - if (err < 0) {
687   - kfree_skb(skb);
  688 + if (err < 0)
  689 + /* skb is already freed */
688 690 goto pipe_err;
689   - }
  691 +
690 692 sent += size;
691 693 }
692 694