1 files changed, 14 insertions, 1 deletions

diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 0c08062d1796..1e2f46a69d50 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -32,6 +32,9 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
         return 0;
 
 nla_put_failure:
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return -1;
 }
@@ -305,7 +308,9 @@ int
 gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 {
         if (d->compat_xstats) {
-                d->xstats = st;
+                d->xstats = kmemdup(st, len, GFP_ATOMIC);
+                if (!d->xstats)
+                        goto err_out;
                 d->xstats_len = len;
         }
 
@@ -313,6 +318,11 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
                 return gnet_stats_copy(d, TCA_STATS_APP, st, len);
 
         return 0;
+
+err_out:
+        d->xstats_len = 0;
+        spin_unlock_bh(d->lock);
+        return -1;
 }
 EXPORT_SYMBOL(gnet_stats_copy_app);
 
@@ -345,6 +355,9 @@ gnet_stats_finish_copy(struct gnet_dump *d)
                         return -1;
         }
 
+        kfree(d->xstats);
+        d->xstats = NULL;
+        d->xstats_len = 0;
         spin_unlock_bh(d->lock);
         return 0;
 }