Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-11-07 04:09:21 +00:00
Code Issues Projects Releases Wiki Activity

caif: Bugfix double kfree_skb upon xmit failure

Browse source 
SKB is freed twice upon send error. The Network stack consumes SKB even
when it returns error code.

Signed-off-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dmitry Tarnyagin 2012-02-02 01:21:03 +00:00 committed by David S. Miller
parent b01377a420
commit ba7605745d
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
net/caif/caif_socket.c
View file

@ -539,8 +539,10 @@ static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
memset(skb->cb, 0, sizeof(struct caif_payload_info));
if (cf_sk->layer.dn == NULL)
if (cf_sk->layer.dn == NULL) {
kfree_skb(skb);
return -EINVAL;
}
return cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
}
@ -683,10 +685,10 @@ static int caif_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
}
err = transmit_skb(skb, cf_sk,
msg->msg_flags&MSG_DONTWAIT, timeo);
if (err < 0) {
kfree_skb(skb);
if (err < 0)
/* skb is already freed */
goto pipe_err;
}
sent += size;
}