Re: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain
flat view
From: Florian Fainelli <f.fainelli@gmail.com>
Date: 2017-06-02 18:48:28
Also in:
linux-wireless, lkml
On 06/02/2017 10:22 AM, Peter S. Housel wrote:
An earlier change to this function (3bdae810721b) fixed a leak in the case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the glob_skb buffer, used for emulating a scattering read, is never used or referenced after its contents are copied into the destination buffers, and therefore always needs to be freed by the end of the function.
That looks correct, could you add the relevant Fixes tag for this?
Fixes: 3bdae810721b ("brcmfmac: Fix glob_skb leak in
brcmf_sdiod_recv_chain")
Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host
without sg support")
BTW, you made the same typo that I did, it's actually glom_skb ;)
quoted hunk ↗ jump to hunk
Signed-off-by: Peter S. Housel <redacted> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index 9b970dc..4c5064f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c@@ -727,15 +727,16 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, return -ENOMEM; err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, glom_skb); - if (err) { - brcmu_pkt_buf_free_skb(glom_skb); - goto done; - } + if (err) + goto free_glom_skb; skb_queue_walk(pktq, skb) { memcpy(skb->data, glom_skb->data, skb->len); skb_pull(glom_skb, skb->len); } + +free_glom_skb: + brcmu_pkt_buf_free_skb(glom_skb); } else err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr, pktq);
-- Florian