diff options
| author | Zhu Yanjun <yanjun.zhu@oracle.com> | 2018-06-07 02:32:52 -0400 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-06-11 11:02:27 -0600 |
| commit | 828d810550abc1fffff9b20545fec4bc150d5e82 (patch) | |
| tree | 63af46473c30b6c01fa7b565d44c176ed62a315e | |
| parent | c1191a19fecad92b73c25770a7f47174280ca564 (diff) | |
| download | linux-stable-828d810550abc1fffff9b20545fec4bc150d5e82.tar.gz linux-stable-828d810550abc1fffff9b20545fec4bc150d5e82.tar.bz2 linux-stable-828d810550abc1fffff9b20545fec4bc150d5e82.zip | |
IB/rxe: avoid double kfree skb
In rxe_send, when network_type is not RDMA_NETWORK_IPV4 or
RDMA_NETWORK_IPV6, skb is freed and -EINVAL is returned.
Then rxe_xmit_packet will return -EINVAL, too. In rxe_requester,
this skb is double freed.
In rxe_requester, kfree_skb is needed only after fill_packet fails.
So kfree_skb is moved from label err to test fill_packet.
Fixes: 5793b4652155 ("IB/rxe: remove unnecessary skb_clone in xmit")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
| -rw-r--r-- | drivers/infiniband/sw/rxe/rxe_req.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c index f30eeba3f772..829ecb93661f 100644 --- a/drivers/infiniband/sw/rxe/rxe_req.c +++ b/drivers/infiniband/sw/rxe/rxe_req.c @@ -709,6 +709,7 @@ next_wqe: if (fill_packet(qp, wqe, &pkt, skb, payload)) { pr_debug("qp#%d Error during fill packet\n", qp_num(qp)); + kfree_skb(skb); goto err; } @@ -740,7 +741,6 @@ next_wqe: goto next_wqe; err: - kfree_skb(skb); wqe->status = IB_WC_LOC_PROT_ERR; wqe->state = wqe_state_error; __rxe_do_task(&qp->comp.task); |