summaryrefslogtreecommitdiff
path: root/net/bluetooth/6lowpan.c
diff options
context:
space:
mode:
authorJukka Rissanen <jukka.rissanen@linux.intel.com>2014-10-01 11:30:57 +0300
committerJohan Hedberg <johan.hedberg@intel.com>2014-10-02 13:41:32 +0300
commita7807d73a0fa9b33dbdfd5f1cb97970ccc91d77e (patch)
treeb1b369c0f169d5c16d21f3cbe2bf998649dd4796 /net/bluetooth/6lowpan.c
parentfc12518a4bcbd4214652291df76f692343bca3d5 (diff)
Bluetooth: 6lowpan: Avoid memory leak if memory allocation fails
If skb_unshare() returns NULL, then we leak the original skb. Solution is to use temp variable to hold the new skb. Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net/bluetooth/6lowpan.c')
-rw-r--r--net/bluetooth/6lowpan.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index add2b58312d7..44eaad77e70c 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -589,13 +589,17 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
int err = 0;
bdaddr_t addr;
u8 addr_type;
+ struct sk_buff *tmpskb;
/* We must take a copy of the skb before we modify/replace the ipv6
* header as the header could be used elsewhere
*/
- skb = skb_unshare(skb, GFP_ATOMIC);
- if (!skb)
+ tmpskb = skb_unshare(skb, GFP_ATOMIC);
+ if (!tmpskb) {
+ kfree_skb(skb);
return NET_XMIT_DROP;
+ }
+ skb = tmpskb;
/* Return values from setup_header()
* <0 - error, packet is dropped