Messages in this thread Patch in this message | | | From | "Adar Dembo" <> | Subject | [PATCH] drivers/isdn/eicon/eicon_idi.c: (2.5.17) dev_kfree_skb on wrong variable | Date | Wed, 29 May 2002 23:32:55 -0700 |
| |
Hello,
The patch below changes one of the dev_kfree_skb() calls, which incorrectly frees the wrong variable, and leaves some memory orphaned. Specifically, in idi_send_data(), two skb's, "xmit_skb" and "skb2" are allocated with alloc_skb. A check is made to see if either allocation failed; if one did, whichever one (if at all) succeeded is dev_kfree_skb()'d, and the function returns an error message. One of these dev_kfree_skb() calls was freeing "skb" instead of "xmit_skb".
Looking at the other calls to idi_send_data() and the rest of the function, I believe "skb" should still be dev_kfree_skb()'d prior to the return, but I am not 100% sure. The maintainer should look into this and fix it if necessary.
-Adar Dembo
--- drivers/isdn/eicon/eicon_idi.c.orig 2002-05-20 22:07:28.000000000 -0700 +++ drivers/isdn/eicon/eicon_idi.c 2002-05-27 01:42:04.000000000 -0700 @@ -2972,7 +2972,7 @@ spin_unlock_irqrestore(&eicon_lock, flags); eicon_log(card, 1, "idi_err: Ch%d: alloc_skb failed in s end_data()\n", chan->No); if (xmit_skb) - dev_kfree_skb(skb); + dev_kfree_skb(xmit_skb); if (skb2) dev_kfree_skb(skb2); return -ENOMEM;
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |