From: Yan-Hsuan Chuang <yhchuang@realtek.com>
Date: Fri, 20 Dec 2019 09:21:55 +0000 (+0800)
Subject: rtw88: assign NULL to skb after being kfree()'ed
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=f48abf064ade7a08015bc3a50a873437375843b2;p=linux.git

rtw88: assign NULL to skb after being kfree()'ed

Should assign NULL to skb after kfree(), in case of driver
trying to free the same skb again.

This could happen if driver failed to allocate an skb when
building reserved page.

Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---

diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
index e3e91ae0d3d23..243441453eade 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.c
+++ b/drivers/net/wireless/realtek/rtw88/fw.c
@@ -1139,13 +1139,16 @@ static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev,
 			page += rtw_len_to_page(rsvd_pkt->skb->len, page_size);
 
 		kfree_skb(rsvd_pkt->skb);
+		rsvd_pkt->skb = NULL;
 	}
 
 	return buf;
 
 release_skb:
-	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list)
+	list_for_each_entry(rsvd_pkt, &rtwdev->rsvd_page_list, list) {
 		kfree_skb(rsvd_pkt->skb);
+		rsvd_pkt->skb = NULL;
+	}
 
 	return NULL;
 }