diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-11-15 22:36:43 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2011-11-16 18:13:38 -0500 |
| commit | d445ba613fe445c8f30733e68089614b40b3df5b (patch) | |
| tree | 048b3c13a4112ad3cdc4464e297207e6cd483e5a | |
| parent | daad6167d97b43cfc448cfe698784730b53ed3d6 (diff) | |
6LoWPAN: double free in lowpan_fragment_xmit()
dev_queue_xmit() consumes its own skb, so the call to dev_kfree_skb()
in lowpan_fragment_xmit() is a double free.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ieee802154/6lowpan.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c index 602f318a8d6..e4ecc1eef98 100644 --- a/net/ieee802154/6lowpan.c +++ b/net/ieee802154/6lowpan.c @@ -980,9 +980,6 @@ lowpan_fragment_xmit(struct sk_buff *skb, u8 *head, ret = dev_queue_xmit(frag); - if (ret < 0) - dev_kfree_skb(frag); - return ret; } |