net: ipa: fix page free in ipa_endpoint_replenish_one()
authorAlex Elder <elder@linaro.org>
Thu, 26 May 2022 15:23:14 +0000 (10:23 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 9 Jun 2022 08:30:55 +0000 (10:30 +0200)
commit 70132763d5d2e94cd185e3aa92ac6a3ba89068fa upstream.

Currently the (possibly compound) pages used for receive buffers are
freed using __free_pages().  But according to this comment above the
definition of that function, that's wrong:
    If you want to use the page's reference count to decide
    when to free the allocation, you should allocate a compound
    page, and use put_page() instead of __free_pages().

Convert the call to __free_pages() in ipa_endpoint_replenish_one()
to use put_page() instead.

Fixes: 6a606b90153b8 ("net: ipa: allocate transaction in replenish loop")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ipa/ipa_endpoint.c

index 158235f649fedb4a670035cf24b862624160e3bc..b9b4cb82790f886184443ade3095d16c6450bc83 100644 (file)
@@ -1062,7 +1062,7 @@ static int ipa_endpoint_replenish_one(struct ipa_endpoint *endpoint,
 
        ret = gsi_trans_page_add(trans, page, len, offset);
        if (ret)
-               __free_pages(page, get_order(buffer_size));
+               put_page(page);
        else
                trans->data = page;     /* transaction owns page now */