llc: free the right skb
authorSorin Dumitru <sdumitru@ixiacom.com>
Mon, 6 Aug 2012 02:35:58 +0000 (02:35 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 6 Aug 2012 20:30:01 +0000 (13:30 -0700)
We are freeing skb instead of nskb, resulting in a double
free on skb and a leak from nskb.

Signed-off-by: Sorin Dumitru <sdumitru@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/llc/llc_station.c

index 39a8d8924b9c989747502774a4360b78e98d6ba4..6828e39ec2ec39688dad610df00076712a1c513f 100644 (file)
@@ -268,7 +268,7 @@ static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 out:
        return rc;
 free:
-       kfree_skb(skb);
+       kfree_skb(nskb);
        goto out;
 }
 
@@ -293,7 +293,7 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 out:
        return rc;
 free:
-       kfree_skb(skb);
+       kfree_skb(nskb);
        goto out;
 }
 
@@ -322,7 +322,7 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 out:
        return rc;
 free:
-       kfree_skb(skb);
+       kfree_skb(nskb);
        goto out;
 }