lkml.org 
[lkml]   [2020]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 103/244] xprtrdma: Fix double-free in rpcrdma_ep_create()
    Date
    From: Chuck Lever <chuck.lever@oracle.com>

    [ Upstream commit 85bfd71bc34e20d9fadb745131f6314c36d0f75b ]

    In the error paths, there's no need to call kfree(ep) after calling
    rpcrdma_ep_put(ep).

    Fixes: e28ce90083f0 ("xprtrdma: kmalloc rpcrdma_ep separate from rpcrdma_xprt")
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/sunrpc/xprtrdma/verbs.c | 7 ++-----
    1 file changed, 2 insertions(+), 5 deletions(-)

    diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
    index db0259c6467ef..4cb91dde849b9 100644
    --- a/net/sunrpc/xprtrdma/verbs.c
    +++ b/net/sunrpc/xprtrdma/verbs.c
    @@ -404,8 +404,8 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)

    id = rpcrdma_create_id(r_xprt, ep);
    if (IS_ERR(id)) {
    - rc = PTR_ERR(id);
    - goto out_free;
    + kfree(ep);
    + return PTR_ERR(id);
    }
    __module_get(THIS_MODULE);
    device = id->device;
    @@ -504,9 +504,6 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
    out_destroy:
    rpcrdma_ep_put(ep);
    rdma_destroy_id(id);
    -out_free:
    - kfree(ep);
    - r_xprt->rx_ep = NULL;
    return rc;
    }

    --
    2.25.1


    \
     
     \ /
      Last update: 2020-07-20 18:22    [W:3.966 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site