30 lines
1.0 KiB
Diff
30 lines
1.0 KiB
Diff
|
Date: Tue, 15 Dec 2015 21:21:56 +0000
|
||
|
From: Ben Hutchings <ben@decadent.org.uk>
|
||
|
Subject: tipc: Fix kfree_skb() of uninitialised pointer
|
||
|
Forwarded: http://mid.gmane.org/20151215212156.GQ28542@decadent.org.uk
|
||
|
|
||
|
Commit 7098356baca7 ("tipc: fix error handling of expanding buffer
|
||
|
headroom") added a "goto tx_error". This is fine upstream, but
|
||
|
when backported to 4.3 it results in attempting to free the clone
|
||
|
before it has been allocated. In this early error case, no
|
||
|
cleanup is needed.
|
||
|
|
||
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||
|
---
|
||
|
net/tipc/udp_media.c | 2 +-
|
||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
||
|
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
|
||
|
index 86f2e7c..73bdf1b 100644
|
||
|
--- a/net/tipc/udp_media.c
|
||
|
+++ b/net/tipc/udp_media.c
|
||
|
@@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
|
||
|
if (skb_headroom(skb) < UDP_MIN_HEADROOM) {
|
||
|
err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
|
||
|
if (err)
|
||
|
- goto tx_error;
|
||
|
+ return err;
|
||
|
}
|
||
|
|
||
|
clone = skb_clone(skb, GFP_ATOMIC);
|