mISDN: Fix skb leak in error cases

If the channel receive function returns an error the skb must be freed.

Signed-off-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 530f68977361f9d58077df3bea0f3d5c091bca22..2a2c30a9438f15c3f3e9e248d22c8b4e56a879c4 100644 (file)
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -209,7 +209,7 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
        if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
                err = -EFAULT;
-               goto drop;
+               goto done;
        }
 
        memcpy(mISDN_HEAD_P(skb), skb->data, MISDN_HEADER_LEN);
@@ -230,19 +230,21 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                     __func__, mISDN_HEAD_ID(skb));
 
        err = -ENODEV;
-       if (!_pms(sk)->ch.peer ||
-           (err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb)))
-               goto drop;
-
-       err = len;
+       if (!_pms(sk)->ch.peer)
+               goto done;
+       err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb);
+       if (err)
+               goto done;
+       else {
+               skb = NULL;
+               err = len;
+       }
 
 done:
+       if (skb)
+               kfree_skb(skb);
        release_sock(sk);
        return err;
-
-drop:
-       kfree_skb(skb);
-       goto done;
 }
 
 static int