| Message ID | 1442917490-26574-1-git-send-email-javier@osg.samsung.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Kalle Valo |
| Headers | show |
On Tue, Sep 22, 2015 at 12:24:50PM +0200, Javier Martinez Canillas wrote: > The wilc_wlan_cleanup() function iterates over the list of transmission > buffers freeing all of them and then iterates over the receive buffers > list to free all of them as well. > > But on the receive loop a pointer to struct txq_entry_t is dereferenced > instead of the pointer to a struct rxq_entry_t. This not only causes a > dereference to a pointer already freed but also leaks the memory in the > struct rxq_entry_t buffer. > > Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") > Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> > > --- > > drivers/staging/wilc1000/wilc_wlan.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c > index 4c25179c2fec..c40f143b00b7 100644 > --- a/drivers/staging/wilc1000/wilc_wlan.c > +++ b/drivers/staging/wilc1000/wilc_wlan.c > @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void) > if (rqe == NULL) > break; > #ifdef MEMORY_DYNAMIC > - kfree(tqe->buffer); > + kfree(rqe->buffer); > #endif MEMORY_DYNAMIC is only used here and no where else. And buffer was allocated in the else part of #ifdef MEMORY_STATIC. So you should really be using #ifndef MEMORY_STATIC here instead of #ifdef MEMORY_DYNAMIC otherwise memory leak will still remain. regards sudip -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hello Sudip, Thanks a lot for your feedback. On 09/22/2015 02:16 PM, Sudip Mukherjee wrote: > On Tue, Sep 22, 2015 at 12:24:50PM +0200, Javier Martinez Canillas wrote: >> The wilc_wlan_cleanup() function iterates over the list of transmission >> buffers freeing all of them and then iterates over the receive buffers >> list to free all of them as well. >> >> But on the receive loop a pointer to struct txq_entry_t is dereferenced >> instead of the pointer to a struct rxq_entry_t. This not only causes a >> dereference to a pointer already freed but also leaks the memory in the >> struct rxq_entry_t buffer. >> >> Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") >> Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> >> >> --- >> >> drivers/staging/wilc1000/wilc_wlan.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c >> index 4c25179c2fec..c40f143b00b7 100644 >> --- a/drivers/staging/wilc1000/wilc_wlan.c >> +++ b/drivers/staging/wilc1000/wilc_wlan.c >> @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void) >> if (rqe == NULL) >> break; >> #ifdef MEMORY_DYNAMIC >> - kfree(tqe->buffer); >> + kfree(rqe->buffer); >> #endif > MEMORY_DYNAMIC is only used here and no where else. And buffer was > allocated in the else part of #ifdef MEMORY_STATIC. > So you should really be using #ifndef MEMORY_STATIC here instead of > #ifdef MEMORY_DYNAMIC otherwise memory leak will still remain. > You are right that #ifndef MEMORY_STATIC should be used instead to fix the memory leak. I'll post a v2 changing that as well. > regards > sudip > Best regards,
diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c index 4c25179c2fec..c40f143b00b7 100644 --- a/drivers/staging/wilc1000/wilc_wlan.c +++ b/drivers/staging/wilc1000/wilc_wlan.c @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void) if (rqe == NULL) break; #ifdef MEMORY_DYNAMIC - kfree(tqe->buffer); + kfree(rqe->buffer); #endif kfree(rqe); } while (1);
The wilc_wlan_cleanup() function iterates over the list of transmission buffers freeing all of them and then iterates over the receive buffers list to free all of them as well. But on the receive loop a pointer to struct txq_entry_t is dereferenced instead of the pointer to a struct rxq_entry_t. This not only causes a dereference to a pointer already freed but also leaks the memory in the struct rxq_entry_t buffer. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com> --- drivers/staging/wilc1000/wilc_wlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)