net: qualcomm: rmnet: Fix a double free

There is a typo here so we accidentally free "skb" instead of "skbn".
It leads to a double free and a leak.  After discussing with Subash,
it's better to just move the check before the allocation and avoid the
need to free.

Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 557c9bf1a46907f672110c3c00472ad81f8fdbcd..86b8c758f94e1fb19cc7d56e52b6b59260ce8565 100644 (file)
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -84,6 +84,10 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb)
        if (((int)skb->len - (int)packet_len) < 0)
                return NULL;
 
+       /* Some hardware can send us empty frames. Catch them */
+       if (ntohs(maph->pkt_len) == 0)
+               return NULL;
+
        skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
        if (!skbn)
                return NULL;
@@ -94,11 +98,5 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb)
        memcpy(skbn->data, skb->data, packet_len);
        skb_pull(skb, packet_len);
 
-       /* Some hardware can send us empty frames. Catch them */
-       if (ntohs(maph->pkt_len) == 0) {
-               kfree_skb(skb);
-               return NULL;
-       }
-
        return skbn;
 }