Clone first, privatize with skb_cow(), reacquire the header or trailer pointer, then write the id: this removes the shared-buffer mutation for both hsr_create_tagged_frame() and prp_create_tagged_frame(). The error paths (clone failure, cow failure, NULL trailer) all free the clone and return NULL, and adding kfree_skb() on the NULL-trailer path also closes a leak. Using skb_cow() rather than skb_cow_head() is right since the PRP RCT sits at the linear tail.
Reviewed-by: Ali Ahmet Memis <[email protected]>
