diff --git a/openbsc/src/gprs/gprs_sndcp.c b/openbsc/src/gprs/gprs_sndcp.c
index 98da4ae..46d779b 100644
--- a/openbsc/src/gprs/gprs_sndcp.c
+++ b/openbsc/src/gprs/gprs_sndcp.c
@@ -358,8 +358,10 @@
 
 	fmsg = msgb_alloc_headroom(fs->sne->lle->params.n201_u+256, 128,
 				   "SNDCP Frag");
-	if (!fmsg)
+	if (!fmsg) {
+		msgb_free(fs->msg);
 		return -ENOMEM;
+	}
 
 	/* make sure lower layers route the fragment like the original */
 	msgb_tlli(fmsg) = msgb_tlli(fs->msg);
@@ -416,9 +418,9 @@
 	sch->more = more;
 
 	rc = gprs_llc_tx_ui(fmsg, lle->sapi, 0, fs->mmcontext);
+	/* abort in case of error, do not advance frag_nr / next_byte */
 	if (rc < 0) {
-		/* abort in case of error, do not advance frag_nr / next_byte */
-		msgb_free(fmsg);
+		msgb_free(fs->msg);
 		return rc;
 	}
 
@@ -450,6 +452,7 @@
 	sne = gprs_sndcp_entity_by_lle(lle, nsapi);
 	if (!sne) {
 		LOGP(DSNDCP, LOGL_ERROR, "Cannot find SNDCP Entity\n");
+		msgb_free(msg);
 		return -EIO;
 	}