dev_queue_xmit() consumes its own skb, so the call to dev_kfree_skb() in lowpan_fragment_xmit() is a double free. Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> --- v2: fixed commit message. diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c index 602f318..e4ecc1e 100644 --- a/net/ieee802154/6lowpan.c +++ b/net/ieee802154/6lowpan.c @@ -980,9 +980,6 @@ lowpan_fragment_xmit(struct sk_buff *skb, u8 *head, ret = dev_queue_xmit(frag); - if (ret < 0) - dev_kfree_skb(frag); - return ret; }
Attachment:
signature.asc
Description: Digital signature
