Commit 5bd1bafd authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Paolo Abeni
Browse files

eth: fbnic: avoid double free when failing to DMA-map FW msg 



The semantics are that caller of fbnic_mbx_map_msg() retains
the ownership of the message on error. All existing callers
dutifully free the page.

Fixes: da3cde08 ("eth: fbnic: Add FW communication mechanism")
Reviewed-by: default avatarAlexander Duyck <alexanderduyck@fb.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Reviewed-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20250616195510.225819-1-kuba@kernel.org


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 9b70c362

drivers/net/ethernet/meta/fbnic/fbnic_fw.c

+1 −4
Original line number Diff line number Diff line
@@ -127,11 +127,8 @@ static int fbnic_mbx_map_msg(struct fbnic_dev *fbd, int mbx_idx, 
		return -EBUSY;



	addr = dma_map_single(fbd->dev, msg, PAGE_SIZE, direction);

	if (dma_mapping_error(fbd->dev, addr)) {

		free_page((unsigned long)msg);



	if (dma_mapping_error(fbd->dev, addr))

		return -ENOSPC;

	}



	mbx->buf_info[tail].msg = msg;

	mbx->buf_info[tail].addr = addr;