[10/11] rtw88: assign NULL to skb after being kfree()'ed
diff mbox series

Message ID 20191220092156.13443-11-yhchuang@realtek.com
State Accepted
Commit f48abf064ade7a08015bc3a50a873437375843b2
Delegated to: Kalle Valo
Headers show
Series
  • rtw88: some driver fixes
Related show

Commit Message

Tony Chuang Dec. 20, 2019, 9:21 a.m. UTC
From: Yan-Hsuan Chuang <yhchuang@realtek.com>

Should assign NULL to skb after kfree(), in case of driver
trying to free the same skb again.

This could happen if driver failed to allocate an skb when
building reserved page.

Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
---
 drivers/net/wireless/realtek/rtw88/fw.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Patch
diff mbox series

diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
index b8c581161f61..92cefb79e09b 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.c
+++ b/drivers/net/wireless/realtek/rtw88/fw.c
@@ -857,13 +857,16 @@  static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev,
 			page += rtw_len_to_page(rsvd_pkt->skb->len, page_size);
 
 		kfree_skb(rsvd_pkt->skb);
+		rsvd_pkt->skb = NULL;
 	}
 
 	return buf;
 
 release_skb:
-	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list)
+	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list) {
 		kfree_skb(rsvd_pkt->skb);
+		rsvd_pkt->skb = NULL;
+	}
 
 	return NULL;
 }