[PATCH net-next] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach

When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Fixes: 05491d2ccf20 ("brcm80211: move under broadcom vendor directory")
Reported-by: Hulk Robot <redacted>
Signed-off-by: Wang Yufen <redacted>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 8bb4f1f..1bb270e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

@@ -1619,6 +1619,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 					  BRCMF_TX_IOCTL_MAX_MSG_SIZE,
 					  msgbuf->ioctbuf,
 					  msgbuf->ioctbuf_handle);
+		if (msgbuf->txflow_wq)
+			destroy_workqueue(msgbuf->txflow_wq);
 		kfree(msgbuf);
 	}
 	return -ENOMEM;

-- 
1.8.3

Wang Yufen [off-list ref] wrote:

When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Fixes: 05491d2ccf20 ("brcm80211: move under broadcom vendor directory")

Moving the driver to another directory cannot have caused this bug, so I'm
removing the fixes tag. Please check your commit logs, don't just blindly copy
what git-blame says.

-- 
https://patchwork.kernel.org/patch/11673291/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Wang Yufen [off-list ref] wrote:

When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Reported-by: Hulk Robot <redacted>
Signed-off-by: Wang Yufen <redacted>

Patch applied to wireless-drivers-next.git, thanks.

6c151410d5b5 brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach

-- 
https://patchwork.kernel.org/patch/11673291/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches