[PATCH 2/4] RDMA/cxgb4: Balance the extra skb reference on rx_pkt() error paths

[Wentao Liang]

rx_pkt() takes an extra reference on the skb with skb_get() so that the
pointer stored in req->cookie stays valid after the handler returns.
process_work() frees the skb once when the handler returns 0, and the
firmware completion path releases the extra reference through that
cookie.

If the route, neighbour or L2 table lookup fails, rx_pkt() returns
without calling send_fw_pass_open_req(), so the extra reference is never
released and the skb is leaked.

Move skb_get() down to just before send_fw_pass_open_req(), where the
reference is actually handed to the firmware.  The early error paths now
leave only the reference owned by process_work(), which releases it when
the handler returns.

Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/infiniband/hw/cxgb4/cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index a6f520f49d59..2cdc4744a24a 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -4134,7 +4134,6 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
 	tcph = (struct tcphdr *)(iph + 1);
 	skb_set_network_header(skb, (void *)iph - (void *)rss);
 	skb_set_transport_header(skb, (void *)tcph - (void *)rss);
-	skb_get(skb);
 
 	pr_debug("lip 0x%x lport %u pip 0x%x pport %u tos %d\n",
 		 ntohl(iph->daddr), ntohs(tcph->dest), ntohl(iph->saddr),
@@ -4193,6 +4192,7 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
 	 * in cpl and pass it through the regular cpl_pass_accept_req path.
 	 */
 	build_cpl_pass_accept_req(skb, stid, iph->tos);
+	skb_get(skb);
 	send_fw_pass_open_req(dev, skb, iph->daddr, tcph->dest, iph->saddr,
 			      tcph->source, ntohl(tcph->seq), filter, window,
 			      rss_qid, pi->port_id);
-- 
2.34.1