public inbox for virtualization@lists.linux-foundation.org
 help / color / mirror / Atom feed
* [PATCH] vdpa: don't free reply skb after genlmsg_reply()
@ 2026-03-12 11:04 Paul Moses
  2026-03-17  1:22 ` Paul Moses
  0 siblings, 1 reply; 4+ messages in thread
From: Paul Moses @ 2026-03-12 11:04 UTC (permalink / raw)
  To: Michael S . Tsirkin, Jason Wang, Xuan Zhuo, Eugenio Pérez,
	Eli Cohen, Parav Pandit
  Cc: virtualization, linux-kernel, Paul Moses, stable

genlmsg_reply() hands the reply skb to netlink, and
netlink_unicast() consumes it on all return paths, whether the
skb is queued successfully or freed on an error path.

vdpa_nl_cmd_dev_config_get_doit() currently jumps to nlmsg_free(msg)
after genlmsg_reply() fails, which can hit the same skb twice.

Return the genlmsg_reply() error directly and keep nlmsg_free()
only for pre-reply failures.

Fixes: ad69dd0bf26b ("vdpa: Introduce query of device config layout")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moses <p@1g4.org>
---
 drivers/vdpa/vdpa.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c
index 34874beb0152e..702d3a7772219 100644
--- a/drivers/vdpa/vdpa.c
+++ b/drivers/vdpa/vdpa.c
@@ -1352,15 +1352,19 @@ static int vdpa_nl_cmd_dev_config_get_doit(struct sk_buff *skb, struct genl_info
 	}
 	err = vdpa_dev_config_fill(vdev, msg, info->snd_portid, info->snd_seq,
 				   0, info->extack);
-	if (!err)
-		err = genlmsg_reply(msg, info);
+	if (err)
+		goto mdev_err;
+
+	put_device(dev);
+	up_read(&vdpa_dev_lock);
+
+	return genlmsg_reply(msg, info);
 
 mdev_err:
 	put_device(dev);
 dev_err:
 	up_read(&vdpa_dev_lock);
-	if (err)
-		nlmsg_free(msg);
+	nlmsg_free(msg);
 	return err;
 }
 
-- 
2.53.GIT



^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-20 22:37 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-12 11:04 [PATCH] vdpa: don't free reply skb after genlmsg_reply() Paul Moses
2026-03-17  1:22 ` Paul Moses
2026-03-20 21:11   ` Paul Moses
2026-03-20 22:37     ` Michael S. Tsirkin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox