On Monday, June 20, 2016 19:53:28 Sven Eckelmann wrote:
batadv_send_skb_packet used by batadv_send_skb_to_orig and its return value is given directly to callers of batadv_send_skb_packet.
batadv_send_skb_to_orig -> batadv_send_unicast_skb -> batadv_send_skb_packet -> dev_queue_xmit
These callers of batadv_send_skb_to_orig expect that the skb isn't consumed when they receive a -1. But dev_queue_xmit may still have consumed it and still returned -1. Thus the free for the skb would be called twice.
Fixes: e3b8acbff9c8 ("batman-adv: return netdev status in the TX path") Signed-off-by: Sven Eckelmann sven@narfation.org
v2:
- rebased on current master
- added patch to a common set of related patches
net/batman-adv/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
Applied in revision a20149c.
Thanks, Marek