1 files changed, 10 insertions, 3 deletions

diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index ca41b0b5afb3..48267bc0b2e0 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -1022,22 +1022,29 @@ static rndis_resp_t *rndis_add_response (int configNr, u32 length)
         return r;
 }
 
-int rndis_rm_hdr(struct sk_buff *skb)
+int rndis_rm_hdr(struct gether *port,
+                        struct sk_buff *skb,
+                        struct sk_buff_head *list)
 {
         /* tmp points to a struct rndis_packet_msg_type */
         __le32          *tmp = (void *) skb->data;
 
         /* MessageType, MessageLength */
         if (cpu_to_le32(REMOTE_NDIS_PACKET_MSG)
-                        != get_unaligned(tmp++))
+                        != get_unaligned(tmp++)) {
+                dev_kfree_skb_any(skb);
                 return -EINVAL;
+        }
         tmp++;
 
         /* DataOffset, DataLength */
-        if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8))
+        if (!skb_pull(skb, get_unaligned_le32(tmp++) + 8)) {
+                dev_kfree_skb_any(skb);
                 return -EOVERFLOW;
+        }
         skb_trim(skb, get_unaligned_le32(tmp++));
 
+        skb_queue_tail(list, skb);
         return 0;
 }