Acked.
Thank you for both your quick fixes, Cong.
///jon
> -----Original Message-----
> From: Cong Wang <xiyou.wangc...@gmail.com>
> Sent: 10-Dec-18 15:46
> To: netdev@vger.kernel.org
> Cc: Cong Wang <xiyou.wangc...@gmail.com>; Ying Xue
> <ying....@windriver.com>; Jon Maloy <jon.ma...@ericsson.com>
> Subject: [Patch net] tipc: fix a double kfree_skb()
>
> tipc_udp_xmit() drops the packet on error, there is no need to drop it again.
>
> Fixes: ef20cd4dd163 ("tipc: introduce UDP replicast")
> Reported-and-tested-by:
> syzbot+eae585ba2cc2752d3...@syzkaller.appspotmail.com
> Cc: Ying Xue <ying....@windriver.com>
> Cc: Jon Maloy <jon.ma...@ericsson.com>
> Signed-off-by: Cong Wang <xiyou.wangc...@gmail.com>
> ---
> net/tipc/udp_media.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index
> 10dc59ce9c82..1b1ba1310ea7 100644
> --- a/net/tipc/udp_media.c
> +++ b/net/tipc/udp_media.c
> @@ -245,10 +245,8 @@ static int tipc_udp_send_msg(struct net *net, struct
> sk_buff *skb,
> }
>
> err = tipc_udp_xmit(net, _skb, ub, src, &rcast->addr);
> - if (err) {
> - kfree_skb(_skb);
> + if (err)
> goto out;
> - }
> }
> err = 0;
> out:
> --
> 2.19.2
