Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966918AbcJFI6t (ORCPT ); Thu, 6 Oct 2016 04:58:49 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:48968 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966106AbcJFI6o (ORCPT ); Thu, 6 Oct 2016 04:58:44 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Fainelli , Arend van Spriel , Kalle Valo Subject: [PATCH 4.4 66/93] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Date: Thu, 6 Oct 2016 10:29:36 +0200 Message-Id: <20161006074734.311781066@linuxfoundation.org> X-Mailer: git-send-email 2.10.0 In-Reply-To: <20161006074731.150212126@linuxfoundation.org> References: <20161006074731.150212126@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1271 Lines: 38 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian Fainelli commit 3bdae810721b33061d2e541bd78a70f86ca42af3 upstream. In case brcmf_sdiod_recv_chain() cannot complete a succeful call to brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we should, fix this. Reported-by: coverity (CID 1164856) Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support") Signed-off-by: Florian Fainelli Acked-by: Arend van Spriel Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c @@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_ return -ENOMEM; err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, glom_skb); - if (err) + if (err) { + brcmu_pkt_buf_free_skb(glom_skb); goto done; + } skb_queue_walk(pktq, skb) { memcpy(skb->data, glom_skb->data, skb->len);