tipc: Fix kfree_skb() of uninitialised pointer (regression in 4.3.3)

debian/changelog

@@ -76,6 +76,7 @@ linux (4.3.3-1) UNRELEASED; urgency=medium
     register_netdevice failure" in 4.3.3
   * net: Ignore ABI changes due to "ipv6: add complete rcu protection around
     np->opt", which don't appear to affect out-of-tree modules
+  * tipc: Fix kfree_skb() of uninitialised pointer (regression in 4.3.3)
 
  -- Ben Hutchings <ben@decadent.org.uk>  Mon, 14 Dec 2015 20:59:37 +0000
 

debian/patches/bugfix/all/tipc-fix-kfree_skb-of-uninitialised-pointer.patch

@@ -0,0 +1,29 @@
+Date: Tue, 15 Dec 2015 21:21:56 +0000
+From: Ben Hutchings <ben@decadent.org.uk>
+Subject: tipc: Fix kfree_skb() of uninitialised pointer
+Forwarded: http://mid.gmane.org/20151215212156.GQ28542@decadent.org.uk
+
+Commit 7098356baca7 ("tipc: fix error handling of expanding buffer
+headroom") added a "goto tx_error".  This is fine upstream, but
+when backported to 4.3 it results in attempting to free the clone
+before it has been allocated.  In this early error case, no
+cleanup is needed.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/tipc/udp_media.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
+index 86f2e7c..73bdf1b 100644
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
+ 	if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
+ 		err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
+ 		if (err)
+-			goto tx_error;
++			return err;
+ 	}
+ 
+ 	clone = skb_clone(skb, GFP_ATOMIC);

debian/patches/series

@@ -103,3 +103,4 @@ features/arm/arm-dts-split-audio-configuration-to-separate-exynos.patch
 features/arm/arm-dts-add-support-odroid-xu4-board-for-exynos5422-.patch
 bugfix/all/revert-vrf-fix-double-free-and-memory-corruption-on-.patch
 bugfix/all/vrf-fix-double-free-and-memory-corruption-on-registe.patch
+bugfix/all/tipc-fix-kfree_skb-of-uninitialised-pointer.patch