If the skb has a frag_list, it must be linearized before it can be split using skb_split(). But when this step failed, it must not only free the skb but also take care of the reference to the already found primary_if.
Reported-by: Sashiko <[email protected]> Fixes: d467720acaf1 ("batman-adv: Don't skb_split skbuffs with frag_list") Signed-off-by: Sven Eckelmann <[email protected]> --- net/batman-adv/fragmentation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c index e2c74ae6..5606e284 100644 --- a/net/batman-adv/fragmentation.c +++ b/net/batman-adv/fragmentation.c @@ -551,7 +551,7 @@ int batadv_frag_send_packet(struct sk_buff *skb, */ if (skb_has_frag_list(skb) && __skb_linearize(skb)) { ret = -ENOMEM; - goto free_skb; + goto put_primary_if; } /* Create one header to be copied to all fragments */ --- base-commit: 22b12d005035f37f898e5bf80480719fe1ef4fba change-id: 20260703-frag-tx-primary-leak-6c2ad9f844a3 Best regards, -- Sven Eckelmann <[email protected]>
