[patch net-next-2.6 v2] skbuff: fix error handling in pskb_copy()
From: Dan Carpenter <hidden>
Date: 2011-07-20 08:53:48
Also in:
netdev
Subsystem:
networking [general], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
There are two problems: 1) "n" was allocated with alloc_skb() so we should free it with kfree_skb() instead of regular kfree(). 2) We return the freed pointer instead of NULL. Signed-off-by: Dan Carpenter <redacted>
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d220119..2beda82 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c@@ -799,7 +799,8 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask) if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) { if (skb_copy_ubufs(skb, gfp_mask)) { - kfree(n); + kfree_skb(n); + n = NULL; goto out; } skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;