62 lines
2.2 KiB
Diff
62 lines
2.2 KiB
Diff
From: Sven Eckelmann <sven@narfation.org>
|
|
Date: Tue, 27 Dec 2016 08:51:17 +0100
|
|
Subject: batman-adv: Decrease hardif refcnt on fragmentation send error
|
|
|
|
An error before the hardif is found has to free the skb. But every error
|
|
after that has to free the skb + put the hard interface.
|
|
|
|
Fixes: 8b4132b1447a ("batman-adv: Consume skb in batadv_frag_send_packet")
|
|
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
|
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
|
|
|
|
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/205dc8385dc863467f4f6ccec2e63254e6baf831
|
|
|
|
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
|
|
index 9c561e683f4b8b68642b626b51a0dcda30260e97..0854ebd8613e9bf9044b04099b11341325d6e194 100644
|
|
--- a/net/batman-adv/fragmentation.c
|
|
+++ b/net/batman-adv/fragmentation.c
|
|
@@ -474,7 +474,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
|
|
primary_if = batadv_primary_if_get_selected(bat_priv);
|
|
if (!primary_if) {
|
|
ret = -EINVAL;
|
|
- goto put_primary_if;
|
|
+ goto free_skb;
|
|
}
|
|
|
|
/* Create one header to be copied to all fragments */
|
|
@@ -502,7 +502,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
|
|
skb_fragment = batadv_frag_create(skb, &frag_header, mtu);
|
|
if (!skb_fragment) {
|
|
ret = -ENOMEM;
|
|
- goto free_skb;
|
|
+ goto put_primary_if;
|
|
}
|
|
|
|
batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_TX);
|
|
@@ -511,7 +511,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
|
|
ret = batadv_send_unicast_skb(skb_fragment, neigh_node);
|
|
if (ret != NET_XMIT_SUCCESS) {
|
|
ret = NET_XMIT_DROP;
|
|
- goto free_skb;
|
|
+ goto put_primary_if;
|
|
}
|
|
|
|
frag_header.no++;
|
|
@@ -519,7 +519,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
|
|
/* The initial check in this function should cover this case */
|
|
if (frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1) {
|
|
ret = -EINVAL;
|
|
- goto free_skb;
|
|
+ goto put_primary_if;
|
|
}
|
|
}
|
|
|
|
@@ -527,7 +527,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
|
|
if (batadv_skb_head_push(skb, header_size) < 0 ||
|
|
pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) {
|
|
ret = -ENOMEM;
|
|
- goto free_skb;
|
|
+ goto put_primary_if;
|
|
}
|
|
|
|
memcpy(skb->data, &frag_header, header_size);
|