Re: [PATCH 2.6.26-rc4] fix double call of kfree_skb in net/llc/llc_sap.c

[Wei Yongjun <yjwei@cn.fujitsu.com>]

Dmitry Petukhov wrote:
> in function llc_sap_state_proces there was lack of return statement,
> and finalizing kfree_skb might be called after skb was already freed
> or queued to the user.
>
> following patch adds the necessary return.
>
>   

Not correct, since kfree_skb(skb) is used after skb_get(skb).

First, it used skb_get inc the users counter, and then, kfree_skb will 
dec the users count, not do the real free.

> ---
>
> --- a/net/llc/llc_sap.c 2008-05-27 12:52:01.000000000 +0600
> +++ b/net/llc/llc_sap.c 2008-05-27 12:52:37.000000000 +0600
> @@ -223,6 +223,7 @@
>                         if (sock_queue_rcv_skb(skb->sk, skb))
>                                 kfree_skb(skb);
>                 }
> +               return;
>         }
>         kfree_skb(skb);
>  }
>