From 45847f7580edd4f2d4a819116967517f77b47685 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Tue, 15 Dec 2015 21:21:57 +0000 Subject: [PATCH] tipc: Fix kfree_skb() of uninitialised pointer Commit 7098356baca7 ("tipc: fix error handling of expanding buffer headroom") added a "goto tx_error". This is fine upstream, but when backported to 4.3 it results in attempting to free the clone before it has been allocated. In this early error case, no cleanup is needed. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- net/tipc/udp_media.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index 86f2e7c44694a..73bdf1baa266e 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -162,7 +162,7 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb, if (skb_headroom(skb) < UDP_MIN_HEADROOM) { err = pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC); if (err) - goto tx_error; + return err; } clone = skb_clone(skb, GFP_ATOMIC); -- 2.47.2