Re: [RFT] mv643xxx_eth_start_xmit oops
From: Francois Romieu <romieu@fr.zoreil.com>
Date: 2006-11-10 21:32:37
Stephen Hemminger [off-list ref] : [...]
skb_linearize is documented to free skb on failure.
__skb_linearize
-> __pskb_pull_tail
-> pskb_expand_head
[...]
data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
if (!data)
goto nodata;
[...]
nodata:
return -ENOMEM;
I don't see where the skb is freed on this path.
Btw, the same __skb_linearize() is followed by a kfree_skb() in
drivers/net/via-velocity.c since 364c6badde0dd62a0a38e5ed67f85d87d6665780
I may be wrong but the source code does not seem completely right either.
--
Ueimor