From: Michael Brown <mcb30@ipxe.org>
Date: Tue, 21 Mar 2017 11:45:17 +0000 (+0200)
Subject: [nfs] Fix double free bug on error path
X-Git-Tag: v1.20.1~286
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e500e5dd07c17d8c8ff5177ddb0a883d89998918;p=thirdparty%2Fipxe.git

[nfs] Fix double free bug on error path

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/net/tcp/oncrpc.c b/src/net/tcp/oncrpc.c
index 6469867e9..cb66aeb85 100644
--- a/src/net/tcp/oncrpc.c
+++ b/src/net/tcp/oncrpc.c
@@ -128,7 +128,6 @@ void oncrpc_init_session ( struct oncrpc_session *session,
 
 int oncrpc_call ( struct interface *intf, struct oncrpc_session *session,
                   uint32_t proc_name, const struct oncrpc_field fields[] ) {
-	int              rc;
 	size_t           frame_size;
 	struct io_buffer *io_buf;
 
@@ -161,11 +160,7 @@ int oncrpc_call ( struct interface *intf, struct oncrpc_session *session,
 	oncrpc_iob_add_fields ( io_buf, header );
 	oncrpc_iob_add_fields ( io_buf, fields );
 
-	rc = xfer_deliver_iob ( intf, io_buf );
-	if ( rc != 0 )
-		free_iob ( io_buf );
-
-	return rc;
+	return xfer_deliver_iob ( intf, iob_disown ( io_buf ) );
 }
 
 size_t oncrpc_compute_size ( const struct oncrpc_field fields[] ) {