The code inside rtw_init_drv_sw() calls various init functions to
populate the padapter structure and checks for their return values
respectively.
But if one of the functions in middle fails then it simply returns
_FAIL instead of proper logging and calling freeing counterparts
of previous init functions.
This leads to various memory leaks and can be found in
/sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.
Fix this and keep the success and error separate.
Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for
RTL8188eu driver")
Reviewed-by: Dan Carpenter <[email protected]>
Reviewed-by: Pavel Skripkin <[email protected]>
Signed-off-by: Vihas Makwana <[email protected]>
---
Tested on Comfast CF-WU810N RTL8188EUS wireless adapter.
---
drivers/staging/r8188eu/os_dep/os_intfs.c | 60 ++++++++++++++++++-----
1 file changed, 47 insertions(+), 13 deletions(-)
diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c
index 197568422..f59b23dc6 100644
--- a/drivers/staging/r8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
@@ -469,32 +469,46 @@ u8 rtw_reset_drv_sw(struct adapter *padapter)
u8 rtw_init_drv_sw(struct adapter *padapter)
{
- if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL)
+ if ((rtw_init_cmd_priv(&padapter->cmdpriv)) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "rtw_init_cmd_priv failed\n");
return _FAIL;
+ }
padapter->cmdpriv.padapter = padapter;
- if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL)
- return _FAIL;
+ if ((rtw_init_evt_priv(&padapter->evtpriv)) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "rtw_init_evt_priv failed\n");
+ goto free_cmd_priv;
+ }
- if (rtw_init_mlme_priv(padapter) == _FAIL)
- return _FAIL;
+ if (rtw_init_mlme_priv(padapter) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "rtw_init_mlme_priv failed\n");
+ goto free_evt_priv;
+ }
rtw_init_wifidirect_timers(padapter);
init_wifidirect_info(padapter, P2P_ROLE_DISABLE);
reset_global_wifidirect_info(padapter);
- if (init_mlme_ext_priv(padapter) == _FAIL)
- return _FAIL;
+ if (init_mlme_ext_priv(padapter) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "init_mlme_ext_priv failed\n");
+ goto free_mlme_priv;
+ }
- if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL)
- return _FAIL;
+ if (_rtw_init_xmit_priv(&padapter->xmitpriv, padapter) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "_rtw_init_xmit_priv failed\n");
+ goto free_mlme_ext;
+ }
- if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL)
- return _FAIL;
+ if (_rtw_init_recv_priv(&padapter->recvpriv, padapter) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "_rtw_init_recv_priv failed\n");
+ goto free_xmit_priv;
+ }
- if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL)
- return _FAIL;
+ if (_rtw_init_sta_priv(&padapter->stapriv) == _FAIL) {
+ dev_err(dvobj_to_dev(padapter->dvobj), "_rtw_init_sta_priv failed\n");
+ goto free_recv_priv;
+ }
padapter->stapriv.padapter = padapter;
@@ -510,6 +524,26 @@ u8 rtw_init_drv_sw(struct adapter *padapter)
spin_lock_init(&padapter->br_ext_lock);
return _SUCCESS;
+
+free_recv_priv:
+ _rtw_free_recv_priv(&padapter->recvpriv);
+
+free_xmit_priv:
+ _rtw_free_xmit_priv(&padapter->xmitpriv);
+
+free_mlme_ext:
+ free_mlme_ext_priv(&padapter->mlmeextpriv);
+
+free_mlme_priv:
+ rtw_free_mlme_priv(&padapter->mlmepriv);
+
+free_evt_priv:
+ rtw_free_evt_priv(&padapter->evtpriv);
+
+free_cmd_priv:
+ rtw_free_cmd_priv(&padapter->cmdpriv);
+
+ return _FAIL;
}
void rtw_cancel_all_timer(struct adapter *padapter)
--
2.30.2
> On Thu, Mar 10, 2022 at 02:20:47AM +0530, Vihas Makwana wrote:
> > The code inside rtw_init_drv_sw() calls various init functions to
> > populate the padapter structure and checks for their return values
> > respectively.
> > But if one of the functions in middle fails then it simply returns
> > _FAIL instead of proper logging and calling freeing counterparts
> > of previous init functions.
> > This leads to various memory leaks and can be found in
> > /sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.
> >
> > Fix this and keep the success and error separate.
> >
> > Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for
> > RTL8188eu driver")
>
> Nit, that needed to be on one line, and no blank line before the next
> ones.
>
Oh okay. I will take care of that when submitting patches in future.
> I've fixed it up now.
>
Thanks Greg.
On Tue, Mar 15, 2022 at 7:49 PM Greg Kroah-Hartman
<[email protected]> wrote:
>
> On Thu, Mar 10, 2022 at 02:20:47AM +0530, Vihas Makwana wrote:
> > The code inside rtw_init_drv_sw() calls various init functions to
> > populate the padapter structure and checks for their return values
> > respectively.
> > But if one of the functions in middle fails then it simply returns
> > _FAIL instead of proper logging and calling freeing counterparts
> > of previous init functions.
> > This leads to various memory leaks and can be found in
> > /sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.
> >
> > Fix this and keep the success and error separate.
> >
> > Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for
> > RTL8188eu driver")
>
> Nit, that needed to be on one line, and no blank line before the next
> ones.
>
> I've fixed it up now.
>
> thanks,
>
> greg k-h
--
Thanks,
Vihas
On Thu, Mar 10, 2022 at 02:20:47AM +0530, Vihas Makwana wrote:
> The code inside rtw_init_drv_sw() calls various init functions to
> populate the padapter structure and checks for their return values
> respectively.
> But if one of the functions in middle fails then it simply returns
> _FAIL instead of proper logging and calling freeing counterparts
> of previous init functions.
> This leads to various memory leaks and can be found in
> /sys/kernel/debug/kmemleak if kernel is compiled with DEBUG_KMEMLEAK=y.
>
> Fix this and keep the success and error separate.
>
> Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for
> RTL8188eu driver")
Nit, that needed to be on one line, and no blank line before the next
ones.
I've fixed it up now.
thanks,
greg k-h