enami tsugutomo <enami@but-b.or.jp> writes:

> Two `goto bad' in ip_output() near the end is doubtful.
> 
> `if (error) goto bad' after the ip_fragment() just leads mbuf leak if
> it returns ENOBUFS.  the for() loop after ip_fragment() can also
> handle error case well.  And the leak actually hangs NFS.
> 
> The `goto bad' in the if-clasue just above ip_fragment() call is
> doubtful.  Why cleanups aren't necessary?

The latter was ok, I missed the `goto done;'

enami.