The tp_meter code frees the skb when the batadv_send_skb_to_orig returns < 0. But the batadv_send_skb_to_orig only defines -1 as return code for failed submits with still valid skbs.
Fixes: 98d7a766b645 ("batman-adv: throughput meter implementation") Signed-off-by: Sven Eckelmann sven@narfation.org --- Interesting because a patch was submitted to net next to remove NET_XMIT_POLICED and return -EINPROGRESS instead.
I will maybe later send more patches because the current way of handling DROPPED/free'd skb/not-freed skb is quite confusing.
net/batman-adv/tp_meter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c index ed99afb..bf6bffb 100644 --- a/net/batman-adv/tp_meter.c +++ b/net/batman-adv/tp_meter.c @@ -615,7 +615,7 @@ static int batadv_tp_send_msg(struct batadv_tp_vars *tp_vars, const u8 *src, batadv_tp_fill_prerandom(tp_vars, data, data_len);
r = batadv_send_skb_to_orig(skb, orig_node, NULL); - if (r < 0) + if (r == -1) kfree_skb(skb);
if (r == NET_XMIT_SUCCESS)