Hi, On Wed, Oct 4, 2023 at 5:22 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > > The skb() is freed by the caller in lowpan_invoke_rx_handlers() so this > free is a double free. > lowpan_frag_rcv() does not call lowpan_invoke_rx_handlers(), it calls lowpan_invoke_frag_rx_handlers(), or is there something I overlooked here? - Alex