Commit 8798b3fb authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller

[NET]: Fix skb fclone error path handling.

On the error path if we allocated an fclone then we will free it in
the wrong pool.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 40727198
...@@ -135,13 +135,15 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here) ...@@ -135,13 +135,15 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask, struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
int fclone) int fclone)
{ {
kmem_cache_t *cache;
struct skb_shared_info *shinfo; struct skb_shared_info *shinfo;
struct sk_buff *skb; struct sk_buff *skb;
u8 *data; u8 *data;
cache = fclone ? skbuff_fclone_cache : skbuff_head_cache;
/* Get the HEAD */ /* Get the HEAD */
skb = kmem_cache_alloc(fclone ? skbuff_fclone_cache : skbuff_head_cache, skb = kmem_cache_alloc(cache, gfp_mask & ~__GFP_DMA);
gfp_mask & ~__GFP_DMA);
if (!skb) if (!skb)
goto out; goto out;
...@@ -180,7 +182,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask, ...@@ -180,7 +182,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
out: out:
return skb; return skb;
nodata: nodata:
kmem_cache_free(skbuff_head_cache, skb); kmem_cache_free(cache, skb);
skb = NULL; skb = NULL;
goto out; goto out;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment