diff options
| author | Bob Pearson <rpearsonhpe@gmail.com> | 2024-03-29 17:55:12 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-05-30 10:49:44 +0300 |
| commit | d337bfdd665bc48e6d1dd4824ed2203011b0dd19 (patch) | |
| tree | a35fdb12a667e279d86f6116d9cad6fc3a151e8b /drivers/infiniband/hw/bnxt_re | |
| parent | ba82921a886183d0a8085130dbf64ac1c51d363e (diff) | |
| download | linux-d337bfdd665bc48e6d1dd4824ed2203011b0dd19.tar.xz | |
RDMA/rxe: Fix incorrect rxe_put in error path
[ Upstream commit 8776618dbbd1b6f210b31509507e1aad461d6435 ]
In rxe_send() a ref is taken on the qp to keep it alive until the
kfree_skb() has a chance to call the skb destructor rxe_skb_tx_dtor()
which drops the reference. If the packet has an incorrect protocol the
error path just calls kfree_skb() which will call the destructor which
will drop the ref. Currently the driver also calls rxe_put() which is
incorrect. Additionally since the packets sent to rxe_send() are under the
control of the driver and it only ever produces IPV4 or IPV6 packets the
simplest fix is to remove all the code in this block.
Link: https://lore.kernel.org/r/20240329145513.35381-12-rpearsonhpe@gmail.com
Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
Fixes: 9eb7f8e44d13 ("IB/rxe: Move refcounting earlier in rxe_send()")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/infiniband/hw/bnxt_re')
0 files changed, 0 insertions, 0 deletions