If the receive function of a tagger reallocated the SKB, the original
SKB is currently not freed. Fix this and free it on both copy or error.

Signed-off-by: Vivien Didelot <vivien.dide...@savoirfairelinux.com>
---
 net/dsa/dsa.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 98173a3f6fd1..0b6f2c7d7d1c 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -209,11 +209,12 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct 
net_device *dev,
        if (!skb)
                return 0;
 
+       /* Receive function may have to reallocate the original SKB */
        nskb = dst->tag_ops->rcv(skb, dev);
-       if (!nskb) {
+       if (nskb != skb)
                kfree_skb(skb);
+       if (!nskb)
                return 0;
-       }
 
        skb = nskb;
        skb_push(skb, ETH_HLEN);
-- 
2.13.0

Reply via email to