| Message ID | 1668657281-28480-1-git-send-email-zhangchangzhong@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [wireless] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
Zhang Changzhong <zhangchangzhong@huawei.com> writes: > The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb > in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. > > Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") > Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> I assume you have not tested this on a real device? Then it would be really important to add "Compile tested only" to the commit log so that we know it's untested.
On 2022/11/17 18:09, Kalle Valo wrote: > Zhang Changzhong <zhangchangzhong@huawei.com> writes: > >> The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb >> in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. >> >> Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") >> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> > > I assume you have not tested this on a real device? Then it would be > really important to add "Compile tested only" to the commit log so that > we know it's untested. > OK, I'll add "Compile tested only" to the next version and other untested patches. Thanks, Changzhong
Zhang Changzhong <zhangchangzhong@huawei.com> writes: > On 2022/11/17 18:09, Kalle Valo wrote: >> Zhang Changzhong <zhangchangzhong@huawei.com> writes: >> >>> The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb >>> in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. >>> >>> Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") >>> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> >> >> I assume you have not tested this on a real device? Then it would be >> really important to add "Compile tested only" to the commit log so that >> we know it's untested. >> > > OK, I'll add "Compile tested only" to the next version and other untested > patches. Thanks. I wish it would become common to use that "Compile tested only".
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 595ae3a..175272c 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -335,6 +335,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, bphy_err(drvr, "%s: failed to expand headroom\n", brcmf_ifname(ifp)); atomic_inc(&drvr->bus_if->stats.pktcow_failed); + dev_kfree_skb(skb); goto done; } }
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + 1 file changed, 1 insertion(+)