diff --git a/openbsc/src/gprs/gprs_llc.c b/openbsc/src/gprs/gprs_llc.c
index cb810c4..c88d162 100644
--- a/openbsc/src/gprs/gprs_llc.c
+++ b/openbsc/src/gprs/gprs_llc.c
@@ -382,6 +382,7 @@
 	if (msg->len > lle->params.n201_u) {
 		LOGP(DLLC, LOGL_ERROR, "Cannot Tx %u bytes (N201-U=%u)\n",
 			msg->len, lle->params.n201_u);
+		msgb_free(msg);
 		return -EFBIG;
 	}
 
@@ -439,6 +440,7 @@
 				     kc, iv, GPRS_CIPH_SGSN2MS);
 		if (rc < 0) {
 			LOGP(DLLC, LOGL_ERROR, "Error crypting UI frame: %d\n", rc);
+			msgb_free(msg);
 			return rc;
 		}
 
diff --git a/openbsc/src/gprs/gprs_sndcp.c b/openbsc/src/gprs/gprs_sndcp.c
index 98da4ae..46d779b 100644
--- a/openbsc/src/gprs/gprs_sndcp.c
+++ b/openbsc/src/gprs/gprs_sndcp.c
@@ -358,8 +358,10 @@
 
 	fmsg = msgb_alloc_headroom(fs->sne->lle->params.n201_u+256, 128,
 				   "SNDCP Frag");
-	if (!fmsg)
+	if (!fmsg) {
+		msgb_free(fs->msg);
 		return -ENOMEM;
+	}
 
 	/* make sure lower layers route the fragment like the original */
 	msgb_tlli(fmsg) = msgb_tlli(fs->msg);
@@ -416,9 +418,9 @@
 	sch->more = more;
 
 	rc = gprs_llc_tx_ui(fmsg, lle->sapi, 0, fs->mmcontext);
+	/* abort in case of error, do not advance frag_nr / next_byte */
 	if (rc < 0) {
-		/* abort in case of error, do not advance frag_nr / next_byte */
-		msgb_free(fmsg);
+		msgb_free(fs->msg);
 		return rc;
 	}
 
@@ -450,6 +452,7 @@
 	sne = gprs_sndcp_entity_by_lle(lle, nsapi);
 	if (!sne) {
 		LOGP(DSNDCP, LOGL_ERROR, "Cannot find SNDCP Entity\n");
+		msgb_free(msg);
 		return -EIO;
 	}