| Message ID | F51492713EF10846800D8C0ED37A7DCE0186947A@SJEXCHMB15.corp.ad.broadcom.com (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c index d7a9745..aea2c2e 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c @@ -771,7 +771,7 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg, struct brcmf_cfg80211_vif *vif; struct net_device *dev = NULL; int i, num_nodfs = 0; - u16 *chanspecs; + u16 *chanspecs = NULL; brcmf_dbg(TRACE, "enter\n"); @@ -825,8 +825,10 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg, action, P2PAPI_BSSCFG_DEVICE); } exit: - if (err) + if (err) { brcmf_err("error (%d)\n", err); + kfree(chanspecs); + } return err; }
Good find, wrong solution. The chanspecs is a temporarily variable which should be freed when exiting the function. Not only when there is an error. I personally would have preferred just a free at the end of the " if (request->n_channels) {". So something like this: } err = brcmf_p2p_escan(p2p, num_nodfs, chanspecs, search_state, action, P2PAPI_BSSCFG_DEVICE); + kfree(chanspecs); } In this case the pointer doesn't have to be initialized to NULL. Regards, Hante -----Original Message----- From: Geyslan G. Bem [mailto:geyslan@gmail.com] Sent: vrijdag 15 november 2013 12:54 To: geyslan@gmail.com Cc: Brett Rudley; Arend Van Spriel; Franky Lin; Hante Meuleman; John W. Linville; Pieter-Paul Giesberts; Piotr Haber; linux-wireless@vger.kernel.org; brcm80211-dev-list; netdev@vger.kernel.org; linux-kernel@vger.kernel.org Subject: [PATCH] brcmfmac: fix possible memory leak In case of error free 'chanspecs'. Signed-off-by: Geyslan G. Bem <geyslan@gmail.com> --- drivers/net/wireless/brcm80211/brcmfmac/p2p.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)