mISDN: Fix skb leak in error cases

If the channel receive function returns an error the skb must be freed.

Signed-off-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 12 insertions, 10 deletions

diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index 530f6897736..2a2c30a9438 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -209,7 +209,7 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
                 err = -EFAULT;
-                goto drop;
+                goto done;
         }
 
         memcpy(mISDN_HEAD_P(skb), skb->data, MISDN_HEADER_LEN);
@@ -230,19 +230,21 @@ mISDN_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                      __func__, mISDN_HEAD_ID(skb));
 
         err = -ENODEV;
-        if (!_pms(sk)->ch.peer ||
-            (err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb)))
-                goto drop;
-
-        err = len;
+        if (!_pms(sk)->ch.peer)
+                goto done;
+        err = _pms(sk)->ch.recv(_pms(sk)->ch.peer, skb);
+        if (err)
+                goto done;
+        else {
+                skb = NULL;
+                err = len;
+        }
 
 done:
+        if (skb)
+                kfree_skb(skb);
         release_sock(sk);
         return err;
-
-drop:
-        kfree_skb(skb);
-        goto done;
 }
 
 static int