Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751244AbdFBRhw (ORCPT ); Fri, 2 Jun 2017 13:37:52 -0400 Received: from fed1rmfepi103.cox.net ([68.230.241.134]:56245 "EHLO fed1rmfepi103.cox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751154AbdFBRhu (ORCPT ); Fri, 2 Jun 2017 13:37:50 -0400 X-Greylist: delayed 556 seconds by postgrey-1.27 at vger.kernel.org; Fri, 02 Jun 2017 13:37:50 EDT X-CT-Class: Clean X-CT-Score: 0.00 X-CT-RefID: str=0001.0A090203.5931A040.00B2,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0 X-CT-Spam: 0 X-Authority-Analysis: v=2.1 cv=ZPF34SPb c=1 sm=1 tr=0 a=2h5joy4Vliq9J2KtwSbkFg==:117 a=2h5joy4Vliq9J2KtwSbkFg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=yEt_ySCYCeAA:10 a=LWSFodeU3zMA:10 a=N54-gffFAAAA:8 a=3T-nJzyC3FGPieS7n5sA:9 a=6l0D2HzqY3Epnrm8mE3f:22 X-CM-Score: 0.00 Authentication-Results: cox.net; none From: "Peter S. Housel" To: Arend van Spriel , Franky Lin , Hante Meuleman , Kalle Valo , Christian Daudt , Pieter-Paul Giesberts , Martin Blumenstingl , Florian Fainelli , "Peter S. Housel" , linux-wireless@vger.kernel.org (open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER), brcm80211-dev-list.pdl@broadcom.com (open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER), netdev@vger.kernel.org (open list:NETWORKING DRIVERS), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Date: Fri, 2 Jun 2017 10:22:21 -0700 Message-Id: <1496424146-10928-1-git-send-email-housel@acm.org> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1380 Lines: 39 An earlier change to this function (3bdae810721b) fixed a leak in the case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the glob_skb buffer, used for emulating a scattering read, is never used or referenced after its contents are copied into the destination buffers, and therefore always needs to be freed by the end of the function. Signed-off-by: Peter S. Housel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index 9b970dc..4c5064f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -727,15 +727,16 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, return -ENOMEM; err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, glom_skb); - if (err) { - brcmu_pkt_buf_free_skb(glom_skb); - goto done; - } + if (err) + goto free_glom_skb; skb_queue_walk(pktq, skb) { memcpy(skb->data, glom_skb->data, skb->len); skb_pull(glom_skb, skb->len); } + +free_glom_skb: + brcmu_pkt_buf_free_skb(glom_skb); } else err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr, pktq); -- 2.7.4