Never free an skb that has been passed to genlmsg_reply().

genlmsg_reply() always consumes its argument, not just in the success case.

diff --git a/datapath/datapath.c b/datapath/datapath.c
index 07fa92d..2a8e5a9 100644 (file)
--- a/datapath/datapath.c
+++ b/datapath/datapath.c
@@ -1176,8 +1176,7 @@ static int dp_genl_query(struct sk_buff *skb, struct genl_info *info)
 
                genlmsg_end(ans_skb, data);
                err = genlmsg_reply(ans_skb, info);
-               if (!err)
-                       ans_skb = NULL;
+               ans_skb = NULL;
        }
 err:
 nla_put_failure: