30 lines
1.0 KiB
Diff
30 lines
1.0 KiB
Diff
Date: Tue, 15 Dec 2015 21:21:56 +0000
|
|
From: Ben Hutchings <ben@decadent.org.uk>
|
|
Subject: tipc: Fix kfree_skb() of uninitialised pointer
|
|
Forwarded: http://mid.gmane.org/20151215212156.GQ28542@decadent.org.uk
|
|
|
|
Commit 7098356baca7 ("tipc: fix error handling of expanding buffer
|
|
headroom") added a "goto tx_error". This is fine upstream, but
|
|
when backported to 4.3 it results in attempting to free the clone
|
|
before it has been allocated. In this early error case, no
|
|
cleanup is needed.
|
|
|
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
---
|
|
net/tipc/udp_media.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
|
|
index 86f2e7c..73bdf1b 100644
|
|
--- a/net/tipc/udp_media.c
|
|
+++ b/net/tipc/udp_media.c
|
|
@@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
|
|
if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
|
|
err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
|
|
if (err)
|
|
- goto tx_error;
|
|
+ return err;
|
|
}
|
|
|
|
clone = skb_clone(skb, GFP_ATOMIC);
|