diff mbox

lpfc: fix double free on mp

Message ID 1438359324-8834-1-git-send-email-colin.king@canonical.com (mailing list archive)
State New, archived
Headers show

Commit Message

Colin King July 31, 2015, 4:15 p.m. UTC 
From: Colin Ian King <colin.king@canonical.com>

The error path when the call to lpfc_sli_issue_mbox returns
MBX_NOT_FINISHED results in the code freeing mp and calling
lpfc_mbuf_free twice.   Fix this by jumping to the correct
part of the error clean up path.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/scsi/lpfc/lpfc_mbox.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox

Patch

diff --git a/drivers/scsi/lpfc/lpfc_mbox.c b/drivers/scsi/lpfc/lpfc_mbox.c
index eb62772..750f34d 100644
--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -2299,13 +2299,14 @@  lpfc_mbx_cmpl_rdp_page_a2(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
 	mbox->mbox_cmpl = lpfc_mbx_cmpl_rdp_link_stat;
 	mbox->context2 = (struct lpfc_rdp_context *) rdp_context;
 	if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT) == MBX_NOT_FINISHED)
-		goto error;
+		goto cmd_free;
 
 	return;
 
 error:
 	lpfc_mbuf_free(phba, mp->virt, mp->phys);
 	kfree(mp);
+cmd_free:
 	lpfc_sli4_mbox_cmd_free(phba, mbox);
 	rdp_context->cmpl(phba, rdp_context, FAILURE);
 }