Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5df3b8bc authored by Karsten Keil's avatar Karsten Keil Committed by David S. Miller
Browse files

mISDN: Fix skb leak in error cases 



If the channel receive function returns an error the skb must be freed.

Signed-off-by: default avatarKarsten Keil <keil@b1-systems.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d796509a

drivers/isdn/mISDN/socket.c

+12 −10
Original line number Diff line number Diff line
@@ -209,7 +209,7 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 


	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {

		err = -EFAULT;

		goto drop;

		goto done;

	}



	memcpy(mISDN_HEAD_P(skb), skb->data, MISDN_HEADER_LEN);
@@ -230,19 +230,21 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 
		     __func__, mISDN_HEAD_ID(skb));



	err = -ENODEV;

	if (!_pms(sk)->ch.peer ||

	    (err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb)))

		goto drop;



	if (!_pms(sk)->ch.peer)

		goto done;

	err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb);

	if (err)

		goto done;

	else {

		skb = NULL;

		err = len;

	}



done:

	if (skb)

		kfree_skb(skb);

	release_sock(sk);

	return err;



drop:

	kfree_skb(skb);

	goto done;

}



static int