if (inet->cork.opt) { kfree(inet->cork.opt); inet->cork.opt = NULL; } 
kfree(inet->cork.opt); inet->cork.opt = NULL; 
int ip_push_pending_frames(struct sock *sk){	struct sk_buff *skb, *tmp_skb;	struct sk_buff **tail_skb;	struct inet_sock *inet = inet_sk(sk);	struct ip_options *opt = NULL;	struct rtable *rt = inet->cork.rt;	struct iphdr *iph;	int df = 0;	__u8 ttl;	int err = 0;	if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)		goto out;	tail_skb = &(skb_shinfo(skb)->frag_list);	/* move skb->data to ip header from ext header */	if (skb->data < skb->nh.raw)		__skb_pull(skb, skb->nh.raw - skb->data);	while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {		__skb_pull(tmp_skb, skb->h.raw - skb->nh.raw);		*tail_skb = tmp_skb;		tail_skb = &(tmp_skb->next);		skb->len += tmp_skb->len;		skb->data_len += tmp_skb->len;		skb->truesize += tmp_skb->truesize;		__sock_put(tmp_skb->sk);		tmp_skb->destructor = NULL;		tmp_skb->sk = NULL;	}	/* Unless user demanded real pmtu discovery (IP_PMTUDISC_DO), we allow	 * to fragment the frame generated here. No matter, what transforms	 * how transforms change size of the packet, it will come out.	 */	if (inet->pmtudisc != IP_PMTUDISC_DO)		skb->local_df = 1;	/* DF bit is set when we want to see DF on outgoing frames.	 * If local_df is set too, we still allow to fragment this frame	 * locally. */	if (inet->pmtudisc == IP_PMTUDISC_DO ||	    (skb->len <= dst_mtu(&rt->u.dst) &&	     ip_dont_fragment(sk, &rt->u.dst)))		df = htons(IP_DF);	if (inet->cork.flags & IPCORK_OPT)		opt = inet->cork.opt;	if (rt->rt_type == RTN_MULTICAST)		ttl = inet->mc_ttl;	else		ttl = ip_select_ttl(inet, &rt->u.dst);	iph = (struct iphdr *)skb->data;	iph->version = 4;	iph->ihl = 5;	if (opt) {		iph->ihl += opt->optlen>>2;		ip_options_build(skb, opt, inet->cork.addr, rt, 0);	}	iph->tos = inet->tos;	iph->tot_len = htons(skb->len);	iph->frag_off = df;	if (!df) {		__ip_select_ident(iph, &rt->u.dst, 0);	} else {		iph->id = htons(inet->id++);	}	iph->ttl = ttl;	iph->protocol = sk->sk_protocol;	iph->saddr = rt->rt_src;	iph->daddr = rt->rt_dst;	ip_send_check(iph);	skb->priority = sk->sk_priority;	skb->dst = dst_clone(&rt->u.dst);	/* Netfilter gets whole the not fragmented skb. */	err = NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, 		      skb->dst->dev, dst_output);	if (err) {		if (err > 0)			err = inet->recverr ? net_xmit_errno(err) : 0;		if (err)			goto error;	}out:	inet->cork.flags &= ~IPCORK_OPT;	if (inet->cork.opt) {		kfree(inet->cork.opt);		inet->cork.opt = NULL;	}	if (inet->cork.rt) {		ip_rt_put(inet->cork.rt);		inet->cork.rt = NULL;	}	return err;error:	IP_INC_STATS(IPSTATS_MIB_OUTDISCARDS);	goto out;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/a51482bde22f99c63fbbb57d5d46cc666384e379/ip_output.c/buggy/net/ipv4/ip_output.c