diff options
| author | Yan-Hsuan Chuang <[email protected]> | 2019-12-20 17:21:55 +0800 |
|---|---|---|
| committer | Kalle Valo <[email protected]> | 2020-01-26 17:38:13 +0200 |
| commit | f48abf064ade7a08015bc3a50a873437375843b2 (patch) | |
| tree | 1abccd8c785a17aa7bcdea6f198d77d82982e511 | |
| parent | fc83c616d4d95c386e2bac7994b635b24662bca4 (diff) | |
rtw88: assign NULL to skb after being kfree()'ed
Should assign NULL to skb after kfree(), in case of driver
trying to free the same skb again.
This could happen if driver failed to allocate an skb when
building reserved page.
Signed-off-by: Yan-Hsuan Chuang <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
| -rw-r--r-- | drivers/net/wireless/realtek/rtw88/fw.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c index e3e91ae0d3d2..243441453ead 100644 --- a/drivers/net/wireless/realtek/rtw88/fw.c +++ b/drivers/net/wireless/realtek/rtw88/fw.c @@ -1139,13 +1139,16 @@ static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev, page += rtw_len_to_page(rsvd_pkt->skb->len, page_size); kfree_skb(rsvd_pkt->skb); + rsvd_pkt->skb = NULL; } return buf; release_skb: - list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list) + list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list) { kfree_skb(rsvd_pkt->skb); + rsvd_pkt->skb = NULL; + } return NULL; } |