drivers/isdn/eicon/eicon_idi.c: (2.5.17) dev_kfree_skb on wrong variable

Hello,

The patch below changes one of the dev_kfree_skb() calls, which
incorrectly frees the wrong variable, and leaves some memory orphaned. Specifically, in idi_send_data(), two skb's, "xmit_skb" and "skb2" are allocated with alloc_skb. A check is made to see if either allocation failed; if one did, whichever one (if at all) succeeded is dev_kfree_skb()'d, and the function returns an error message. One of these dev_kfree_skb() calls was freeing "skb" instead of "xmit_skb".

Looking at the other calls to idi_send_data() and the rest of
the function, I believe "skb" should still be dev_kfree_skb()'d prior to the return, but I am not 100% sure. The maintainer should look into this and fix it if necessary.

-Adar Dembo

--- drivers/isdn/eicon/eicon_idi.c.orig 2002-05-20 22:07:28.000000000 -0700
+++ drivers/isdn/eicon/eicon_idi.c 2002-05-27
01:42:04.000000000 -0700
@@ -2972,7 +2972,7 @@
spin_unlock_irqrestore(&eicon_lock, flags); eicon_log(card, 1, "idi_err: Ch%d: alloc_skb
failed in s
end_data()\n", chan->No);
if (xmit_skb)
- dev_kfree_skb(skb);

+                               dev_kfree_skb(xmit_skb);
                        if (skb2)
                                dev_kfree_skb(skb2);
                        return -ENOMEM;