lkml.org 
[lkml]   [2020]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 037/137] rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
    Date
    From: Ping-Ke Shih <pkshih@realtek.com>

    [ Upstream commit 5174f1e41074b5186608badc2e89441d021e8c08 ]

    This leak was found by testing the EDIMAX EW-7612 on Raspberry Pi 3B+ with
    Linux 5.4-rc5 (multi_v7_defconfig + rtlwifi + kmemleak) and noticed a
    single memory leak during probe:

    unreferenced object 0xec13ee40 (size 176):
    comm "kworker/u8:1", pid 36, jiffies 4294939321 (age 5580.790s)
    hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    backtrace:
    [<fc1bbb3e>] __netdev_alloc_skb+0x9c/0x164
    [<863dfa6e>] rtl92c_set_fw_rsvdpagepkt+0x254/0x340 [rtl8192c_common]
    [<9572be0d>] rtl92cu_set_hw_reg+0xf48/0xfa4 [rtl8192cu]
    [<116df4d8>] rtl_op_bss_info_changed+0x234/0x96c [rtlwifi]
    [<8933575f>] ieee80211_bss_info_change_notify+0xb8/0x264 [mac80211]
    [<d4061e86>] ieee80211_assoc_success+0x934/0x1798 [mac80211]
    [<e55adb56>] ieee80211_rx_mgmt_assoc_resp+0x174/0x314 [mac80211]
    [<5974629e>] ieee80211_sta_rx_queued_mgmt+0x3f4/0x7f0 [mac80211]
    [<d91091c6>] ieee80211_iface_work+0x208/0x318 [mac80211]
    [<ac5fcae4>] process_one_work+0x22c/0x564
    [<f5e6d3b6>] worker_thread+0x44/0x5d8
    [<82c7b073>] kthread+0x150/0x154
    [<b43e1b7d>] ret_from_fork+0x14/0x2c
    [<794dff30>] 0x0

    It is because 8192cu doesn't implement usb_cmd_send_packet(), and this
    patch just frees the skb within the function to resolve memleak problem
    by now. Since 8192cu doesn't turn on fwctrl_lps that needs to download
    command packet for firmware via the function, applying this patch doesn't
    affect driver behavior.

    Reported-by: Stefan Wahren <wahrenst@gmx.net>
    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
    index 34ce06441d1b..137d7c8645da 100644
    --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
    +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c
    @@ -1601,6 +1601,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
    * This is maybe necessary:
    * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
    */
    + dev_kfree_skb(skb);
    +
    return true;
    }

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-02 23:43    [W:3.694 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site