Commit ded26023 authored Mar 08, 2017 by Dan Carpenter Committed by Doug Ledford Mar 24, 2017

IB/rxe: double free on error



"goto err;" has it's own kfree_skb() call so it's a double free.  We
only need to free on the "goto exit;" path.

Fixes: 8700e3e7 ("Soft RoCE driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

parent b172679b

drivers/infiniband/sw/rxe/rxe_req.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -729,11 +729,11 @@ int rxe_requester(void *arg)
		ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
		if (ret) {
		qp->need_req_skb = 1;
		kfree_skb(skb);

		rollback_state(wqe, qp, &rollback_wqe, rollback_psn);

		if (ret == -EAGAIN) {
		kfree_skb(skb);
		rxe_run_task(&qp->req.task, 1);
		goto exit;
		}