If the receive function of a tagger reallocated the SKB, the original SKB is currently not freed. Fix this and free it on both copy or error.
Signed-off-by: Vivien Didelot <vivien.dide...@savoirfairelinux.com> --- net/dsa/dsa.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index 98173a3f6fd1..0b6f2c7d7d1c 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -209,11 +209,12 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev, if (!skb) return 0; + /* Receive function may have to reallocate the original SKB */ nskb = dst->tag_ops->rcv(skb, dev); - if (!nskb) { + if (nskb != skb) kfree_skb(skb); + if (!nskb) return 0; - } skb = nskb; skb_push(skb, ETH_HLEN); -- 2.13.0