From patchwork Fri Jun 2 22:29:25 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Peter S. Housel" X-Patchwork-Id: 9763659 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3841A602BF for ; Fri, 2 Jun 2017 22:34:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2AE2228577 for ; Fri, 2 Jun 2017 22:34:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1DDDF285C7; Fri, 2 Jun 2017 22:34:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.4 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C889428577 for ; Fri, 2 Jun 2017 22:34:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751267AbdFBWd7 (ORCPT ); Fri, 2 Jun 2017 18:33:59 -0400 Received: from fed1rmfepo202.cox.net ([68.230.241.147]:57107 "EHLO fed1rmfepo202.cox.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751135AbdFBWd5 (ORCPT ); Fri, 2 Jun 2017 18:33:57 -0400 Received: from fed1rmimpo109.cox.net ([68.230.241.158]) by fed1rmfepo202.cox.net (InterMail vM.8.01.05.28 201-2260-151-171-20160122) with ESMTP id <20170602223356.UJQZ26070.fed1rmfepo202.cox.net@fed1rmimpo109.cox.net> for ; Fri, 2 Jun 2017 18:33:56 -0400 Received: from expanse-fc64.housel.dyndns.org ([70.187.180.87]) by fed1rmimpo109.cox.net with cox id TyZv1v00F1tYKWE01yZv8k; Fri, 02 Jun 2017 18:33:56 -0400 X-CT-Class: Clean X-CT-Score: 0.00 X-CT-RefID: str=0001.0A090202.5931E7D4.004F, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0 X-CT-Spam: 0 X-Authority-Analysis: v=2.1 cv=do17cwU4 c=1 sm=1 tr=0 a=2h5joy4Vliq9J2KtwSbkFg==:117 a=2h5joy4Vliq9J2KtwSbkFg==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=yEt_ySCYCeAA:10 a=LWSFodeU3zMA:10 a=N54-gffFAAAA:8 a=tXdZ3O06Hv3787NtjWwA:9 a=6l0D2HzqY3Epnrm8mE3f:22 X-CM-Score: 0.00 Authentication-Results: cox.net; none Received: from expanse-ux64.housel.dyndns.org (expanse-ux64.housel.dyndns.org [10.0.0.160]) by expanse-fc64.housel.dyndns.org (8.15.2/8.15.2) with ESMTP id v52MXsso081166; Fri, 2 Jun 2017 15:33:54 -0700 (PDT) (envelope-from housel@acm.org) From: "Peter S. Housel" To: Arend van Spriel , Franky Lin , Hante Meuleman , Kalle Valo , Pieter-Paul Giesberts , Christian Daudt , Florian Fainelli , Florian Westphal , Martin Blumenstingl , "Peter S. Housel" , linux-wireless@vger.kernel.org (open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER), brcm80211-dev-list.pdl@broadcom.com (open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER), netdev@vger.kernel.org (open list:NETWORKING DRIVERS), linux-kernel@vger.kernel.org (open list) Subject: [PATCH v2] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Date: Fri, 2 Jun 2017 15:29:25 -0700 Message-Id: <1496442569-11307-1-git-send-email-housel@acm.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: References: Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP An earlier change to this function (3bdae810721b) fixed a leak in the case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the glom_skb buffer, used for emulating a scattering read, is never used or referenced after its contents are copied into the destination buffers, and therefore always needs to be freed by the end of the function. Fixes: 3bdae810721b ("brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain") Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support") Signed-off-by: Peter S. Housel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c index 9b970dc..30fb54e 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c @@ -727,15 +727,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev, return -ENOMEM; err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, glom_skb); - if (err) { - brcmu_pkt_buf_free_skb(glom_skb); - goto done; - } - - skb_queue_walk(pktq, skb) { - memcpy(skb->data, glom_skb->data, skb->len); - skb_pull(glom_skb, skb->len); + if (!err) { + skb_queue_walk(pktq, skb) { + memcpy(skb->data, glom_skb->data, skb->len); + skb_pull(glom_skb, skb->len); + } } + brcmu_pkt_buf_free_skb(glom_skb); } else err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr, pktq);