[NET]: Fix skb fclone error path handling.

On the error path if we allocated an fclone then we will free it in
the wrong pool.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 3 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d0732e9c8560..6766f118f070 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -135,13 +135,15 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
                             int fclone)
 {
+        kmem_cache_t *cache;
         struct skb_shared_info *shinfo;
         struct sk_buff *skb;
         u8 *data;
 
+        cache = fclone ? skbuff_fclone_cache : skbuff_head_cache;
+
         /* Get the HEAD */
-        skb = kmem_cache_alloc(fclone ? skbuff_fclone_cache : skbuff_head_cache,
-                                gfp_mask & ~__GFP_DMA);
+        skb = kmem_cache_alloc(cache, gfp_mask & ~__GFP_DMA);
         if (!skb)
                 goto out;
 
@@ -180,7 +182,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
 out:
         return skb;
 nodata:
-        kmem_cache_free(skbuff_head_cache, skb);
+        kmem_cache_free(cache, skb);
         skb = NULL;
         goto out;
 }