Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1ce1d471 authored by Steve Wise's avatar Steve Wise Committed by Roland Dreier
Browse files

RDMA/cxgb4: Fix possible memory leak in RX_PKT processing 



If cxgb4_ofld_send() returns < 0, then send_fw_pass_open_req() must
free the request skb and the saved skb with the tcp header.

Signed-off-by: default avatarSteve Wise <swise@opengridcomputing.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent dbb084cc

drivers/infiniband/hw/cxgb4/cm.c

+8 −1
Original line number Diff line number Diff line
@@ -3204,6 +3204,7 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb, 
	struct sk_buff *req_skb;

	struct fw_ofld_connection_wr *req;

	struct cpl_pass_accept_req *cpl = cplhdr(skb);

	int ret;



	req_skb = alloc_skb(sizeof(struct fw_ofld_connection_wr), GFP_KERNEL);

	req = (struct fw_ofld_connection_wr *)__skb_put(req_skb, sizeof(*req));
@@ -3240,7 +3241,13 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb, 
	req->cookie = (unsigned long)skb;



	set_wr_txq(req_skb, CPL_PRIORITY_CONTROL, port_id);

	cxgb4_ofld_send(dev->rdev.lldi.ports[0], req_skb);

	ret = cxgb4_ofld_send(dev->rdev.lldi.ports[0], req_skb);

	if (ret < 0) {

		pr_err("%s - cxgb4_ofld_send error %d - dropping\n", __func__,

		       ret);

		kfree_skb(skb);

		kfree_skb(req_skb);

	}

}



/*