lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 238/757] ath11k: fix a double free and a memory leak
    Date
    From: Tom Rix <trix@redhat.com>

    [ Upstream commit 7e8453e35e406981d7c529ff8f804285bc894ba3 ]

    clang static analyzer reports this problem

    mac.c:6204:2: warning: Attempt to free released memory
    kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    The channels pointer is allocated in ath11k_mac_setup_channels_rates()
    When it fails midway, it cleans up the memory it has already allocated.
    So the error handling needs to skip freeing the memory.

    There is a second problem.
    ath11k_mac_setup_channels_rates(), allocates 3 channels. err_free
    misses releasing ar->mac.sbands[NL80211_BAND_6GHZ].channels

    Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
    Signed-off-by: Tom Rix <trix@redhat.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20200906212625.17059-1-trix@redhat.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
    index 94ae2b9ea6635..4674f0aca8e9b 100644
    --- a/drivers/net/wireless/ath/ath11k/mac.c
    +++ b/drivers/net/wireless/ath/ath11k/mac.c
    @@ -6006,7 +6006,7 @@ static int __ath11k_mac_register(struct ath11k *ar)
    ret = ath11k_mac_setup_channels_rates(ar,
    cap->supported_bands);
    if (ret)
    - goto err_free;
    + goto err;

    ath11k_mac_setup_ht_vht_cap(ar, cap, &ht_cap);
    ath11k_mac_setup_he_cap(ar, cap);
    @@ -6120,7 +6120,9 @@ static int __ath11k_mac_register(struct ath11k *ar)
    err_free:
    kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
    kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels);
    + kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels);

    +err:
    SET_IEEE80211_DEV(ar->hw, NULL);
    return ret;
    }
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 17:10    [W:2.159 / U:0.512 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site