frag_kfree_skb(free_it); 
frag_kfree_skb(free_it, NULL); 
static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb, 			     struct frag_hdr *fhdr, int nhoff){	struct sk_buff *prev, *next;	int offset, end;	if (fq->last_in & COMPLETE) {		DEBUGP("Allready completed\n");		goto err;	}	offset = ntohs(fhdr->frag_off) & ~0x7;	end = offset + (ntohs(skb->nh.ipv6h->payload_len) -			((u8 *) (fhdr + 1) - (u8 *) (skb->nh.ipv6h + 1)));	if ((unsigned int)end > IPV6_MAXPLEN) {		DEBUGP("offset is too large.\n"); 		return -1;	} 	if (skb->ip_summed == CHECKSUM_HW) 		skb->csum = csum_sub(skb->csum, 				     csum_partial(skb->nh.raw,						  (u8*)(fhdr + 1) - skb->nh.raw,						  0));	/* Is this the final fragment? */	if (!(fhdr->frag_off & htons(IP6_MF))) {		/* If we already have some bits beyond end		 * or have different end, the segment is corrupted.		 */		if (end < fq->len ||		    ((fq->last_in & LAST_IN) && end != fq->len)) {			DEBUGP("already received last fragment\n");			goto err;		}		fq->last_in |= LAST_IN;		fq->len = end;	} else {		/* Check if the fragment is rounded to 8 bytes.		 * Required by the RFC.		 */		if (end & 0x7) {			/* RFC2460 says always send parameter problem in			 * this case. -DaveM			 */			DEBUGP("the end of this fragment is not rounded to 8 bytes.\n");			return -1;		}		if (end > fq->len) {			/* Some bits beyond end -> corruption. */			if (fq->last_in & LAST_IN) {				DEBUGP("last packet already reached.\n");				goto err;			}			fq->len = end;		}	}	if (end == offset)		goto err;	/* Point into the IP datagram 'data' part. */	if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) {		DEBUGP("queue: message is too short.\n");		goto err;	}	if (end-offset < skb->len) {		if (pskb_trim(skb, end - offset)) {			DEBUGP("Can't trim\n");			goto err;		}		if (skb->ip_summed != CHECKSUM_UNNECESSARY)			skb->ip_summed = CHECKSUM_NONE;	}	/* Find out which fragments are in front and at the back of us	 * in the chain of fragments so far.  We must know where to put	 * this fragment, right?	 */	prev = NULL;	for (next = fq->fragments; next != NULL; next = next->next) {		if (NFCT_FRAG6_CB(next)->offset >= offset)			break;	/* bingo! */		prev = next;	}	/* We found where to put this one.  Check for overlap with	 * preceding fragment, and, if needed, align things so that	 * any overlaps are eliminated.	 */	if (prev) {		int i = (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset;		if (i > 0) {			offset += i;			if (end <= offset) {				DEBUGP("overlap\n");				goto err;			}			if (!pskb_pull(skb, i)) {				DEBUGP("Can't pull\n");				goto err;			}			if (skb->ip_summed != CHECKSUM_UNNECESSARY)				skb->ip_summed = CHECKSUM_NONE;		}	}	/* Look for overlap with succeeding segments.	 * If we can merge fragments, do it.	 */	while (next && NFCT_FRAG6_CB(next)->offset < end) {		/* overlap is 'i' bytes */		int i = end - NFCT_FRAG6_CB(next)->offset;		if (i < next->len) {			/* Eat head of the next overlapped fragment			 * and leave the loop. The next ones cannot overlap.			 */			DEBUGP("Eat head of the overlapped parts.: %d", i);			if (!pskb_pull(next, i))				goto err;			/* next fragment */			NFCT_FRAG6_CB(next)->offset += i;			fq->meat -= i;			if (next->ip_summed != CHECKSUM_UNNECESSARY)				next->ip_summed = CHECKSUM_NONE;			break;		} else {			struct sk_buff *free_it = next;			/* Old fragmnet is completely overridden with			 * new one drop it.			 */			next = next->next;			if (prev)				prev->next = next;			else				fq->fragments = next;			fq->meat -= free_it->len;			frag_kfree_skb(free_it);		}	}	NFCT_FRAG6_CB(skb)->offset = offset;	/* Insert this fragment in the chain of fragments. */	skb->next = next;	if (prev)		prev->next = skb;	else		fq->fragments = skb;	skb->dev = NULL;	skb_get_timestamp(skb, &fq->stamp);	fq->meat += skb->len;	atomic_add(skb->truesize, &nf_ct_frag6_mem);	/* The first fragment.	 * nhoffset is obtained from the first fragment, of course.	 */	if (offset == 0) {		fq->nhoffset = nhoff;		fq->last_in |= FIRST_IN;	}	write_lock(&nf_ct_frag6_lock);	list_move_tail(&fq->lru_list, &nf_ct_frag6_lru_list);	write_unlock(&nf_ct_frag6_lock);	return 0;err:	return -1;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/1ba430bc3e243d38c0bb2b185bea664b04fc59df/nf_conntrack_reasm.c/buggy/net/ipv6/netfilter/nf_conntrack_reasm.c