lkml.org 
[lkml]   [2016]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.7 103/141] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain
    Date
    4.7-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Florian Fainelli <f.fainelli@gmail.com>

    commit 3bdae810721b33061d2e541bd78a70f86ca42af3 upstream.

    In case brcmf_sdiod_recv_chain() cannot complete a succeful call to
    brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we
    should, fix this.

    Reported-by: coverity (CID 1164856)
    Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
    +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
    @@ -722,8 +722,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_
    return -ENOMEM;
    err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
    glom_skb);
    - if (err)
    + if (err) {
    + brcmu_pkt_buf_free_skb(glom_skb);
    goto done;
    + }

    skb_queue_walk(pktq, skb) {
    memcpy(skb->data, glom_skb->data, skb->len);

    \
     
     \ /
      Last update: 2016-10-06 11:43    [W:3.177 / U:0.412 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site