From f48abf064ade7a08015bc3a50a873437375843b2 Mon Sep 17 00:00:00 2001 From: Yan-Hsuan Chuang Date: Fri, 20 Dec 2019 17:21:55 +0800 Subject: [PATCH] rtw88: assign NULL to skb after being kfree()'ed Should assign NULL to skb after kfree(), in case of driver trying to free the same skb again. This could happen if driver failed to allocate an skb when building reserved page. Signed-off-by: Yan-Hsuan Chuang Signed-off-by: Kalle Valo --- drivers/net/wireless/realtek/rtw88/fw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c index e3e91ae0d3d2..243441453ead 100644 --- a/drivers/net/wireless/realtek/rtw88/fw.c +++ b/drivers/net/wireless/realtek/rtw88/fw.c @@ -1139,13 +1139,16 @@ static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev, page += rtw_len_to_page(rsvd_pkt->skb->len, page_size); kfree_skb(rsvd_pkt->skb); + rsvd_pkt->skb = NULL; } return buf; release_skb: - list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list) + list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list) { kfree_skb(rsvd_pkt->skb); + rsvd_pkt->skb = NULL; + } return NULL; } -- GitLab