if (tmp_hdr) kfree(tmp_hdr); 
kfree(tmp_hdr); 
static int ipcomp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb){	int err = 0;	u8 nexthdr = 0;	int hdr_len = skb->h.raw - skb->nh.raw;	unsigned char *tmp_hdr = NULL;	struct ipv6hdr *iph;	int plen, dlen;	struct ipcomp_data *ipcd = x->data;	u8 *start, *scratch;	struct crypto_tfm *tfm;	int cpu;	if ((skb_is_nonlinear(skb) || skb_cloned(skb)) &&		skb_linearize(skb, GFP_ATOMIC) != 0) {		err = -ENOMEM;		goto out;	}	skb->ip_summed = CHECKSUM_NONE;	/* Remove ipcomp header and decompress original payload */	iph = skb->nh.ipv6h;	tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC);	if (!tmp_hdr)		goto out;	memcpy(tmp_hdr, iph, hdr_len);	nexthdr = *(u8 *)skb->data;	skb_pull(skb, sizeof(struct ipv6_comp_hdr)); 	skb->nh.raw += sizeof(struct ipv6_comp_hdr);	memcpy(skb->nh.raw, tmp_hdr, hdr_len);	iph = skb->nh.ipv6h;	iph->payload_len = htons(ntohs(iph->payload_len) - sizeof(struct ipv6_comp_hdr));	skb->h.raw = skb->data;	/* decompression */	plen = skb->len;	dlen = IPCOMP_SCRATCH_SIZE;	start = skb->data;	cpu = get_cpu();	scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);	tfm = *per_cpu_ptr(ipcd->tfms, cpu);	err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);	if (err) {		err = -EINVAL;		goto out_put_cpu;	}	if (dlen < (plen + sizeof(struct ipv6_comp_hdr))) {		err = -EINVAL;		goto out_put_cpu;	}	err = pskb_expand_head(skb, 0, dlen - plen, GFP_ATOMIC);	if (err) {		goto out_put_cpu;	}	skb_put(skb, dlen - plen);	memcpy(skb->data, scratch, dlen);	iph = skb->nh.ipv6h;	iph->payload_len = htons(skb->len);	out_put_cpu:	put_cpu();out:	if (tmp_hdr)		kfree(tmp_hdr);	if (err)		goto error_out;	return nexthdr;error_out:	return err;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/a51482bde22f99c63fbbb57d5d46cc666384e379/ipcomp6.c/clean/net/ipv6/ipcomp6.c