Commit ac679364 authored by Ursula Braun's avatar Ursula Braun Committed by David S. Miller
Browse files

net/smc: fix double kfree in smc_listen_work() 



If smc_listen_rmda_finish() returns with an error, the storage
addressed by 'buf' is freed a second time.
Consolidate freeing under a common label and jump to that label.

Fixes: 6bb14e48 ("net/smc: dynamic allocation of CLC proposal buffer")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarUrsula Braun <ubraun@linux.ibm.com>
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 86d009f1

net/smc/af_smc.c

+2 −2
Original line number Diff line number Diff line
@@ -1371,7 +1371,6 @@ static void smc_listen_work(struct work_struct *work) 
	}



	/* finish worker */

	kfree(buf);

	if (!ism_supported) {

		rc = smc_listen_rdma_finish(new_smc, &cclc,

					    ini.first_contact_local);
@@ -1381,12 +1380,13 @@ static void smc_listen_work(struct work_struct *work) 
	}

	smc_conn_save_peer_info(new_smc, &cclc);

	smc_listen_out_connected(new_smc);

	return;

	goto out_free;



out_unlock:

	mutex_unlock(&smc_server_lgr_pending);

out_decl:

	smc_listen_decline(new_smc, rc, ini.first_contact_local);

out_free:

	kfree(buf);

}