Commit 8798b3fb authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[NET]: Fix skb fclone error path handling. 



On the error path if we allocated an fclone then we will free it in
the wrong pool.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 40727198

net/core/skbuff.c

+5 −3
Original line number Diff line number Diff line
@@ -135,13 +135,15 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here) 
struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,

			    int fclone)

{

	kmem_cache_t *cache;

	struct skb_shared_info *shinfo;

	struct sk_buff *skb;

	u8 *data;



	cache = fclone ? skbuff_fclone_cache : skbuff_head_cache;



	/* Get the HEAD */

	skb = kmem_cache_alloc(fclone ? skbuff_fclone_cache : skbuff_head_cache,

				gfp_mask & ~__GFP_DMA);

	skb = kmem_cache_alloc(cache, gfp_mask & ~__GFP_DMA);

	if (!skb)

		goto out;
@@ -180,7 +182,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask, 
out:

	return skb;

nodata:

	kmem_cache_free(skbuff_head_cache, skb);

	kmem_cache_free(cache, skb);

	skb = NULL;

	goto out;

}