| Message ID | b1dc67b62bcc53ad02e86099ac0aab312109094b.1593491298.git.sean.wang@mediatek.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Felix Fietkau |
| Headers | show |
| Series | [1/3] mt76: mt7663u: fix memory leak in set key | expand |
> From: Sean Wang <sean.wang@mediatek.com> > > Fix potential memory leak in mcu message handler on error condition. > Acked-by: Lorenzo Bianconi <lorenzo@kernel.org> > Fixes: 0e6a29e477f3 ("mt76: mt7615: add support to read temperature from mcu") > Signed-off-by: Sean Wang <sean.wang@mediatek.com> > --- > drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c > index 1b46cccd93c5..58e3838a3dba 100644 > --- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c > +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c > @@ -183,8 +183,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, > struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data; > int ret = 0; > > - if (seq != rxd->seq) > - return -EAGAIN; > + if (seq != rxd->seq) { > + ret = -EAGAIN; > + goto out; > + } > > switch (cmd) { > case MCU_CMD_PATCH_SEM_CONTROL: > @@ -215,6 +217,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, > default: > break; > } > +out: > dev_kfree_skb(skb); > > return ret; > -- > 2.25.1
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c index 1b46cccd93c5..58e3838a3dba 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c @@ -183,8 +183,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data; int ret = 0; - if (seq != rxd->seq) - return -EAGAIN; + if (seq != rxd->seq) { + ret = -EAGAIN; + goto out; + } switch (cmd) { case MCU_CMD_PATCH_SEM_CONTROL: @@ -215,6 +217,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, default: break; } +out: dev_kfree_skb(skb); return ret;