lkml.org 
[lkml]   [2019]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 52/65] RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case
    Date
    From: Potnuri Bharat Teja <bharat@chelsio.com>

    [ Upstream commit d4934f45693651ea15357dd6c7c36be28b6da884 ]

    _put_ep_safe() and _put_pass_ep_safe() free the skb before it is freed by
    process_work(). fix double free by freeing the skb only in process_work().

    Fixes: 1dad0ebeea1c ("iw_cxgb4: Avoid touch after free error in ARP failure handlers")
    Link: https://lore.kernel.org/r/1572006880-5800-1-git-send-email-bharat@chelsio.com
    Signed-off-by: Dakshaja Uppalapati <dakshaja@chelsio.com>
    Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
    Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/infiniband/hw/cxgb4/cm.c | 2 --
    1 file changed, 2 deletions(-)

    diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
    index e5752352e0fb1..605d50ad123cc 100644
    --- a/drivers/infiniband/hw/cxgb4/cm.c
    +++ b/drivers/infiniband/hw/cxgb4/cm.c
    @@ -490,7 +490,6 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)

    ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
    release_ep_resources(ep);
    - kfree_skb(skb);
    return 0;
    }

    @@ -501,7 +500,6 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
    ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
    c4iw_put_ep(&ep->parent_ep->com);
    release_ep_resources(ep);
    - kfree_skb(skb);
    return 0;
    }

    --
    2.20.1


    \
     
     \ /
      Last update: 2019-11-11 19:35    [W:4.806 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site