[PATCH] RDMA/iwpm: fix kref bypass in iwpm_register_pid() error path

[Wentao Liang]

iwpm_get_nlmsg_request() returns a request with kref_init() +
kref_get() (refcount=2, one for the caller and one for the
iwpm_nlmsg_req_list). On the error path, iwpm_register_pid()
calls iwpm_free_nlmsg_request() directly instead of using
kref_put(), bypassing the kref mechanism and freeing the object
while the refcount is still non-zero.

Replace the direct iwpm_free_nlmsg_request() call with
kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request).

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/infiniband/core/iwpm_msg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 4625abd29ac0..672b0c33a6de 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -122,7 +122,7 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
 	pr_info("%s: %s (client = %u)\n", __func__, err_str, nl_client);
 	dev_kfree_skb(skb);
 	if (nlmsg_request)
-		iwpm_free_nlmsg_request(&nlmsg_request->kref);
+		kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
 	return ret;
 }
 
-- 
2.34.1