We have disbalance between skb refcounting on RX and TX path. This patch fixes the issue. The WARN_ON_ONCE() will trigger if j1939_tp_send() is the last owner of the skb. The skb is owned by the session now. Signed-off-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx> --- net/can/j1939/transport.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 894db7e751c9..ac5ecbd8606d 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1293,6 +1293,9 @@ int j1939_tp_send(struct j1939_priv *priv, struct sk_buff *skb) if (!session) return -ENOMEM; + /* skb is recounted in j1939_session_new() */ + WARN_ON_ONCE(skb_unref(skb)); + session->extd = extd; session->transmission = true; session->pkt.total = (skb->len + 6) / 7; -- 2.19.1
