diff mbox

[resend] rsi: Fix a potential memory leak in rsi_set_channel()

Message ID 20140410203146.767149e7@spike (mailing list archive)
State Not Applicable, archived
Headers show

Commit Message

Christian Engelmayer April 10, 2014, 6:31 p.m. UTC
Fix a potential memory leak in function rsi_set_channel() that is used to
program channel changes. The channel check block for the frequency bands
directly exits the function in case of an error, thus leaving an already
allocated skb unreferenced. Move the checks above allocating the skb.
Detected by Coverity: CID 1195576.

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
---
Applies against git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
Compile tested.
---
 drivers/net/wireless/rsi/rsi_91x_mgmt.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

Comments

Greg KH April 10, 2014, 7:54 p.m. UTC | #1
On Thu, Apr 10, 2014 at 03:46:12PM -0400, Andev wrote:
> Adding Greg KH,

Why do I care about this?

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Andev April 10, 2014, 8:01 p.m. UTC | #2
On Thu, Apr 10, 2014 at 3:54 PM, Greg Kroah-Hartman <greg@kroah.com> wrote:
> On Thu, Apr 10, 2014 at 03:46:12PM -0400, Andev wrote:
>> Adding Greg KH,
>
> Why do I care about this?
>

I am not sure if this needs to be applied to stable too. Should I have
cc'ed stable@?
Dan Carpenter April 10, 2014, 8:07 p.m. UTC | #3
On Thu, Apr 10, 2014 at 04:01:35PM -0400, Andev wrote:
> On Thu, Apr 10, 2014 at 3:54 PM, Greg Kroah-Hartman <greg@kroah.com> wrote:
> > On Thu, Apr 10, 2014 at 03:46:12PM -0400, Andev wrote:
> >> Adding Greg KH,
> >
> > Why do I care about this?
> >
> 
> I am not sure if this needs to be applied to stable too. Should I have
> cc'ed stable@?

Read Documentation/stable_kernel_rules.txt.

But for netdev, then Dave M. maintains a queue of patches which go to
stable.  So this would go through Dave's stable queue and he forwards
them to Greg.

regards,
dan carpenter

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Christian Engelmayer April 10, 2014, 8:13 p.m. UTC | #4
On Thu, 10 Apr 2014 16:01:35 -0400, Andev <debiandev@gmail.com> wrote:
> On Thu, Apr 10, 2014 at 3:54 PM, Greg Kroah-Hartman <greg@kroah.com> wrote:
> > On Thu, Apr 10, 2014 at 03:46:12PM -0400, Andev wrote:
> >> Adding Greg KH,
> >
> > Why do I care about this?
> >
> 
> I am not sure if this needs to be applied to stable too. Should I have
> cc'ed stable@?
> 

Besides what Dan pointed out, this driver has just been pulled recently and afaik
is not included in v3.14. see http://www.spinics.net/lists/netdev/msg276519.html

Regards,
Christian
diff mbox

Patch

diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 2361a68..be5b1fd 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -841,16 +841,6 @@  int rsi_set_channel(struct rsi_common *common, u16 channel)
 	rsi_dbg(MGMT_TX_ZONE,
 		"%s: Sending scan req frame\n", __func__);
 
-	skb = dev_alloc_skb(FRAME_DESC_SZ);
-	if (!skb) {
-		rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
-			__func__);
-		return -ENOMEM;
-	}
-
-	memset(skb->data, 0, FRAME_DESC_SZ);
-	mgmt_frame = (struct rsi_mac_frame *)skb->data;
-
 	if (common->band == IEEE80211_BAND_5GHZ) {
 		if ((channel >= 36) && (channel <= 64))
 			channel = ((channel - 32) / 4);
@@ -868,6 +858,16 @@  int rsi_set_channel(struct rsi_common *common, u16 channel)
 		}
 	}
 
+	skb = dev_alloc_skb(FRAME_DESC_SZ);
+	if (!skb) {
+		rsi_dbg(ERR_ZONE, "%s: Failed in allocation of skb\n",
+			__func__);
+		return -ENOMEM;
+	}
+
+	memset(skb->data, 0, FRAME_DESC_SZ);
+	mgmt_frame = (struct rsi_mac_frame *)skb->data;
+
 	mgmt_frame->desc_word[0] = cpu_to_le16(RSI_WIFI_MGMT_Q << 12);
 	mgmt_frame->desc_word[1] = cpu_to_le16(SCAN_REQUEST);
 	mgmt_frame->desc_word[4] = cpu_to_le16(channel);