lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 008/252] brcmfmac: Fix use after free in brcmf_sdio_readframes()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]

    The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
    static checker warning:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
    error: dereferencing freed memory 'pkt'

    It looks like there was supposed to be a continue after we free "pkt".

    Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Franky Lin <franky.lin@broadcom.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    index 5c3b62e619807..e0211321fe9e8 100644
    --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
    @@ -1934,6 +1934,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
    BRCMF_SDIO_FT_NORMAL)) {
    rd->len = 0;
    brcmu_pkt_buf_free_skb(pkt);
    + continue;
    }
    bus->sdcnt.rx_readahead_cnt++;
    if (rd->len != roundup(rd_new.len, 16)) {
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 17:41    [W:4.039 / U:0.292 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site