Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp1429482pxb; Wed, 20 Oct 2021 05:05:47 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwed4B9hNTG2fXFkxwvoiM7x9twloh7pwEjLxLM/rXdChtlQR4GFXN9A4P1Ih6VgAZVdbGF X-Received: by 2002:a05:6512:e84:: with SMTP id bi4mr11760423lfb.497.1634731546666; Wed, 20 Oct 2021 05:05:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1634731546; cv=none; d=google.com; s=arc-20160816; b=x5LbAN+ir/75icUOVPP0w8mg+8zs4zD4v0YYafWZHS1viKpUmkd3hHFRqCxga43GI3 jxnTZHtSFwJEW5wyLPRACrXUfKsXxCr8Fr/y/n63VZl8kcBu/4sTmXLdg9byEjey8qUM OKu9WT7rn4jlRMfJnoB+1fuHq3RIm9TK3I34I7NXU4WivoTTI8Q0BT4IJaulrVLBw8fF hURWrq32Wt5AG36clNSxBaAzaY4TglwjDKIz8NTnxubYPcnMuZKsFd/zM2E405UblMJo BKkTSU/fOIGMVtyNd3pPV4gIR8Drk99r0NZVcadxGaFvSxTDCDBdICg7SxbWHhOQusql /O5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=Bh9Uu15I+qzAfU6XfiN1y8+hSbXDwAMwx3W2qzzEeMA=; b=h8laTsKW3X/wKYxq+yV1+vGpMU2pyBezk8easBkBpeWIMCE3CK+/h5jrNQHNNLLB7n Rv5Jx3V64kXHu5rVO1O8B6sqHbALacPGCnqgBEqaj49kpE58SJNBztNWGTJz+Xa5ctC+ a0h5sG7gui9OTdeqW++deHJnGyblxRWV2XJH6484HCQAT5iTx0dNQGVmkGaSfIvPY03c imFYKRgdTjMGHoUNosf0/5xdYwjRMXq2kohou1wtAwdgoMNegmpFEZ4a3fh6WfXchfSl NG9kd00NvanMQ3V+VlgqFme7TudhO/ZZJTUu+IiDwVrTtut0HHYBXwqpumdyAeR1yLbR EfRQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l19si3517129ejo.24.2021.10.20.05.05.29; Wed, 20 Oct 2021 05:05:46 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-wireless-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230299AbhJTMHI (ORCPT + 64 others); Wed, 20 Oct 2021 08:07:08 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:13959 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230274AbhJTMHE (ORCPT ); Wed, 20 Oct 2021 08:07:04 -0400 Received: from dggemv711-chm.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4HZ8Px0bkKzZcPN; Wed, 20 Oct 2021 20:03:01 +0800 (CST) Received: from kwepemm600001.china.huawei.com (7.193.23.3) by dggemv711-chm.china.huawei.com (10.1.198.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 20:04:42 +0800 Received: from huawei.com (10.175.104.82) by kwepemm600001.china.huawei.com (7.193.23.3) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 20:04:41 +0800 From: Wang Hai To: , , , , , , , CC: , , , Subject: [PATCH v2 wireless-drivers 1/2] libertas_tf: Fix possible memory leak in probe and disconnect Date: Wed, 20 Oct 2021 20:03:44 +0800 Message-ID: <20211020120345.2016045-2-wanghai38@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20211020120345.2016045-1-wanghai38@huawei.com> References: <20211020120345.2016045-1-wanghai38@huawei.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.104.82] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To kwepemm600001.china.huawei.com (7.193.23.3) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org I got memory leak as follows when doing fault injection test: unreferenced object 0xffff88810a2ddc00 (size 512): comm "kworker/6:1", pid 176, jiffies 4295009893 (age 757.220s) hex dump (first 32 bytes): 00 50 05 18 81 88 ff ff 00 00 00 00 00 00 00 00 .P.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] slab_post_alloc_hook+0x9c/0x490 [] kmem_cache_alloc_trace+0x1f7/0x470 [] if_usb_probe+0x60/0x37c [libertas_tf_usb] [] usb_probe_interface+0x1aa/0x3c0 [usbcore] [] really_probe+0x190/0x480 [] __driver_probe_device+0xf9/0x180 [] driver_probe_device+0x53/0x130 [] __device_attach_driver+0x105/0x130 [] bus_for_each_drv+0x129/0x190 [] __device_attach+0x1c9/0x270 [] device_initial_probe+0x20/0x30 [] bus_probe_device+0x142/0x160 [] device_add+0x829/0x1300 [] usb_set_configuration+0xb01/0xcc0 [usbcore] [] usb_generic_driver_probe+0x6e/0x90 [usbcore] [] usb_probe_device+0x6f/0x130 [usbcore] cardp is missing being freed in the error handling path of the probe and the path of the disconnect, which will cause memory leak. This patch adds the missing kfree(). Fixes: c305a19a0d0a ("libertas_tf: usb specific functions") Reported-by: Hulk Robot Signed-off-by: Wang Hai --- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c index fe0a69e804d8..75b5319d033f 100644 --- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c +++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c @@ -230,6 +230,7 @@ static int if_usb_probe(struct usb_interface *intf, dealloc: if_usb_free(cardp); + kfree(cardp); error: lbtf_deb_leave(LBTF_DEB_MAIN); return -ENOMEM; @@ -254,6 +255,7 @@ static void if_usb_disconnect(struct usb_interface *intf) /* Unlink and free urb */ if_usb_free(cardp); + kfree(cardp); usb_set_intfdata(intf, NULL); usb_put_dev(interface_to_usbdev(intf)); -- 2.25.1