> The first call of skb_put_padto() will free up the SKB on error, but we
> return NULL which tells dsa_slave_xmit() that the original SKB should be
> freed so this would lead to a double free here.
>
> The second skb_put_padto() already frees the passed sk_buff reference
> upon error, so calling kfree_skb() on it again is not necessary.
>
> Detected by CoverityScan, CID#1416687 ("USE_AFTER_FREE")
>
> Fixes: e71cb9e00922 ("net: dsa: ksz: fix skb freeing")
> Signed-off-by: Florian Fainelli <[email protected]>
Reviewed-by: Woojung Huh <[email protected]>
- Woojung
