]> git.baikalelectronics.ru Git - kernel.git/commitdiff
RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case
authorPotnuri Bharat Teja <bharat@chelsio.com>
Fri, 25 Oct 2019 12:34:40 +0000 (18:04 +0530)
committerJason Gunthorpe <jgg@mellanox.com>
Mon, 28 Oct 2019 17:13:33 +0000 (14:13 -0300)
_put_ep_safe() and _put_pass_ep_safe() free the skb before it is freed by
process_work(). fix double free by freeing the skb only in process_work().

Fixes: adea8d3ecaf5 ("iw_cxgb4: Avoid touch after free error in ARP failure handlers")
Link: https://lore.kernel.org/r/1572006880-5800-1-git-send-email-bharat@chelsio.com
Signed-off-by: Dakshaja Uppalapati <dakshaja@chelsio.com>
Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/hw/cxgb4/cm.c

index 9e8eca7b613c096dc3a919dbbcb723ef063d0b9e..347dc242fb8829eab1fca133e61da178cad78081 100644 (file)
@@ -495,7 +495,6 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
 
        ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
        release_ep_resources(ep);
-       kfree_skb(skb);
        return 0;
 }
 
@@ -506,7 +505,6 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
        ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
        c4iw_put_ep(&ep->parent_ep->com);
        release_ep_resources(ep);
-       kfree_skb(skb);
        return 0;
 }