Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 828d8105 authored by Zhu Yanjun's avatar Zhu Yanjun Committed by Jason Gunthorpe
Browse files

IB/rxe: avoid double kfree skb 



In rxe_send, when network_type is not RDMA_NETWORK_IPV4 or
RDMA_NETWORK_IPV6, skb is freed and -EINVAL is returned.
Then rxe_xmit_packet will return -EINVAL, too. In rxe_requester,
this skb is double freed.
In rxe_requester, kfree_skb is needed only after fill_packet fails.
So kfree_skb is moved from label err to test fill_packet.

Fixes: 5793b465 ("IB/rxe: remove unnecessary skb_clone in xmit")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarZhu Yanjun <yanjun.zhu@oracle.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent c1191a19

drivers/infiniband/sw/rxe/rxe_req.c

+1 −1
Original line number Diff line number Diff line
@@ -709,6 +709,7 @@ int rxe_requester(void *arg) 


	if (fill_packet(qp, wqe, &pkt, skb, payload)) {

		pr_debug("qp#%d Error during fill packet\n", qp_num(qp));

		kfree_skb(skb);

		goto err;

	}
@@ -740,7 +741,6 @@ int rxe_requester(void *arg) 
	goto next_wqe;



err:

	kfree_skb(skb);

	wqe->status = IB_WC_LOC_PROT_ERR;

	wqe->state = wqe_state_error;

	__rxe_do_task(&qp->comp.task);