Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases

In fc_disc_gpn_id_resp(), skb is supposed to get freed in all cases except
for PTR_ERR. However, in some cases it didn't.

This fix is to call fc_frame_free(fp) before function returns.

Link: https://lore.kernel.org/r/20200729081824.30996-2-jhasan@marvell.com
Reviewed-by: Girish Basrur <gbasrur@marvell.com>
Reviewed-by: Santosh Vernekar <svernekar@marvell.com>
Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
Reviewed-by: Shyam Sundar <ssundar@marvell.com>
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Javed Hasan and committed by
Martin K. Petersen
ec007ef4 e95b4789

+9 -3
+9 -3
drivers/scsi/libfc/fc_disc.c
··· 581 581 582 582 if (PTR_ERR(fp) == -FC_EX_CLOSED) 583 583 goto out; 584 - if (IS_ERR(fp)) 585 - goto redisc; 584 + if (IS_ERR(fp)) { 585 + mutex_lock(&disc->disc_mutex); 586 + fc_disc_restart(disc); 587 + mutex_unlock(&disc->disc_mutex); 588 + goto out; 589 + } 586 590 587 591 cp = fc_frame_payload_get(fp, sizeof(*cp)); 588 592 if (!cp) ··· 613 609 new_rdata->disc_id = disc->disc_id; 614 610 fc_rport_login(new_rdata); 615 611 } 616 - goto out; 612 + goto free_fp; 617 613 } 618 614 rdata->disc_id = disc->disc_id; 619 615 mutex_unlock(&rdata->rp_mutex); ··· 630 626 fc_disc_restart(disc); 631 627 mutex_unlock(&disc->disc_mutex); 632 628 } 629 + free_fp: 630 + fc_frame_free(fp); 633 631 out: 634 632 kref_put(&rdata->kref, fc_rport_destroy); 635 633 if (!IS_ERR(fp))