diff mbox series

[net-next] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach

Message ID 1595237765-66238-1-git-send-email-wangyufen@huawei.com
State Accepted
Commit 6c151410d5b57e6bb0d91a735ac511459539a7bf
Delegated to: Kalle Valo
Headers show
Series [net-next] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach | expand

Commit Message

Wang Yufen July 20, 2020, 9:36 a.m. UTC
When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Fixes: 05491d2ccf20 ("brcm80211: move under broadcom vendor directory")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Kalle Valo Aug. 2, 2020, 3:29 p.m. UTC | #1
Wang Yufen <wangyufen@huawei.com> wrote:

> When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
> we should destroy the workqueue.
> 
> Fixes: 05491d2ccf20 ("brcm80211: move under broadcom vendor directory")

Moving the driver to another directory cannot have caused this bug, so I'm
removing the fixes tag. Please check your commit logs, don't just blindly copy
what git-blame says.
Kalle Valo Aug. 18, 2020, 12:47 p.m. UTC | #2
Wang Yufen <wangyufen@huawei.com> wrote:

> When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
> we should destroy the workqueue.
> 
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Wang Yufen <wangyufen@huawei.com>

Patch applied to wireless-drivers-next.git, thanks.

6c151410d5b5 brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach
diff mbox series

Patch

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
index 8bb4f1f..1bb270e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
@@ -1619,6 +1619,8 @@  int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 					  BRCMF_TX_IOCTL_MAX_MSG_SIZE,
 					  msgbuf->ioctbuf,
 					  msgbuf->ioctbuf_handle);
+		if (msgbuf->txflow_wq)
+			destroy_workqueue(msgbuf->txflow_wq);
 		kfree(msgbuf);
 	}
 	return -ENOMEM;