do_mq_notify(): saner skb freeing on failures

cleanup is convoluted enough as it is; it's easier to have early
failure outs do explicit kfree_skb(nc), rather than going to
contortions needed to reuse the cleanup from late failures.

Signed-off-by: Al Viro <[email protected]>

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index fd05e3d4f7b632ce15336dc0918ac1b549b40636..48640a36263797ba7911c4c07d892d62e6b1a601 100644 (file)
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -1347,8 +1347,8 @@ static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
                        if (copy_from_user(nc->data,
                                        notification->sigev_value.sival_ptr,
                                        NOTIFY_COOKIE_LEN)) {
-                               ret = -EFAULT;
-                               goto free_skb;
+                               kfree_skb(nc);
+                               return -EFAULT;
                        }
 
                        /* TODO: add a header? */
@@ -1357,16 +1357,14 @@ static int do_mq_notify(mqd_t mqdes, const struct sigevent *notification)
 retry:
                        sock = netlink_getsockbyfd(notification->sigev_signo);
                        if (IS_ERR(sock)) {
-                               ret = PTR_ERR(sock);
-                               goto free_skb;
+                               kfree_skb(nc);
+                               return PTR_ERR(sock);
                        }
 
                        timeo = MAX_SCHEDULE_TIMEOUT;
                        ret = netlink_attachskb(sock, nc, &timeo, NULL);
-                       if (ret == 1) {
-                               sock = NULL;
+                       if (ret == 1)
                                goto retry;
-                       }
                        if (ret)
                                return ret;
                }
@@ -1425,10 +1423,6 @@ out_fput:
 out:
        if (sock)
                netlink_detachskb(sock, nc);
-       else
-free_skb:
-               dev_kfree_skb(nc);
-
        return ret;
 }