Hello Jeremy Kerr, Commit 8892c0490779 ("mctp: Add route input to socket tests") from Oct 3, 2021 (linux-next), leads to the following Smatch static checker warning: net/mctp/test/route-test.c:369 mctp_test_route_input_sk() warn: 'skb' was already freed. (line 365) net/mctp/test/route-test.c 344 static void mctp_test_route_input_sk(struct kunit *test) 345 { 346 const struct mctp_route_input_sk_test *params; 347 struct sk_buff *skb, *skb2; 348 struct mctp_test_route *rt; 349 struct mctp_test_dev *dev; 350 struct socket *sock; 351 int rc; 352 353 params = test->param_value; 354 355 __mctp_route_test_init(test, &dev, &rt, &sock, MCTP_NET_ANY); 356 357 skb = mctp_test_create_skb_data(¶ms->hdr, ¶ms->type); 358 KUNIT_ASSERT_NOT_ERR_OR_NULL(test, skb); 359 360 mctp_test_skb_set_dev(skb, dev); 361 362 rc = mctp_route_input(&rt->rt, skb); ^^^ skb freed here 363 364 if (params->deliver) { 365 KUNIT_EXPECT_EQ(test, rc, 0); 366 367 skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc); 368 KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2); --> 369 KUNIT_EXPECT_EQ(test, skb->len, 1); ^^^^^^^^ I wonder if this was intended to be skb2->len? 370 371 skb_free_datagram(sock->sk, skb2); 372 373 } else { 374 KUNIT_EXPECT_NE(test, rc, 0); 375 skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc); 376 KUNIT_EXPECT_NULL(test, skb2); 377 } 378 379 __mctp_route_test_fini(test, dev, rt, sock); 380 } regards, dan carpenter