diff options
| author |   Steve Wise <swise@opengridcomputing.com> | 2014-03-21 20:40:31 +0530 |
|---|---|---|
| committer |   Roland Dreier <roland@purestorage.com> | 2014-03-24 10:07:35 -0700 |
| commit | 1ce1d471acb7ad8e8b8e3a2972de9fbb5f2be79a (patch) | |
| tree | e3a7a0765510a0f85d1bb2d940828110dda1bb5c /drivers/infiniband/hw/cxgb4/cm.c | |
| parent | RDMA/cxgb4: Don't leak skb in c4iw_uld_rx_handler() (diff) | |
| download | linux-dev-1ce1d471acb7ad8e8b8e3a2972de9fbb5f2be79a.tar.xz linux-dev-1ce1d471acb7ad8e8b8e3a2972de9fbb5f2be79a.zip | |
RDMA/cxgb4: Fix possible memory leak in RX_PKT processing
If cxgb4_ofld_send() returns < 0, then send_fw_pass_open_req() must
free the request skb and the saved skb with the tcp header.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband/hw/cxgb4/cm.c')
| -rw-r--r-- | drivers/infiniband/hw/cxgb4/cm.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index e1fc5c5445c9..773d010a249c 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -3204,6 +3204,7 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb, struct sk_buff *req_skb; struct fw_ofld_connection_wr *req; struct cpl_pass_accept_req *cpl = cplhdr(skb); + int ret; req_skb = alloc_skb(sizeof(struct fw_ofld_connection_wr), GFP_KERNEL); req = (struct fw_ofld_connection_wr *)__skb_put(req_skb, sizeof(*req)); @@ -3240,7 +3241,13 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb, req->cookie = (unsigned long)skb; set_wr_txq(req_skb, CPL_PRIORITY_CONTROL, port_id); - cxgb4_ofld_send(dev->rdev.lldi.ports[0], req_skb); + ret = cxgb4_ofld_send(dev->rdev.lldi.ports[0], req_skb); + if (ret < 0) { + pr_err("%s - cxgb4_ofld_send error %d - dropping\n", __func__, + ret); + kfree_skb(skb); + kfree_skb(req_skb); + } } /* |