Subject: Re: [RFT] mv643xxx_eth_start_xmit oops

From: Stephen Hemminger <[email-masked]>
Date: Fri, 10 Nov 2006 13:35:55 -0800

On Fri, 10 Nov 2006 22:30:43 +0100
Francois Romieu <[email-masked]> wrote:

> Stephen Hemminger <[email-masked]> :
> [...]
> > skb_linearize is documented to free skb on failure.
> 
> __skb_linearize
> -> __pskb_pull_tail
>    -> pskb_expand_head
>       [...]
>         data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
>         if (!data)
>                 goto nodata;
>       [...]
> nodata:
>         return -ENOMEM;
> 
> I don't see where the skb is freed on this path.
> 
> Btw, the same __skb_linearize() is followed by a kfree_skb() in
> drivers/net/via-velocity.c since 364c6badde0dd62a0a38e5ed67f85d87d6665780
> 
> I may be wrong but the source code does not seem completely right either.

Your correct, it does leave the skb alone. so it would be a leak.
Better documentation in skb_linearize would help.

-- 
Stephen Hemminger <[email-masked]>