The skb() is freed by the caller in lowpan_invoke_rx_handlers() so this
free is a double free.
Fixes: 7240cdec60b1 ("6lowpan: handling 6lowpan fragmentation via inet_frag api")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
>From static analysis, untested.
net/ieee802154/6lowpan/reassembly.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index 6dd960ec558c..1ccefc07049c 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -313,7 +313,6 @@ int lowpan_frag_rcv(struct sk_buff *skb, u8 frag_type)
}
err:
- kfree_skb(skb);
return -1;
}
--
2.39.2
