source: branches/chaos_calmer/package/kernel/mac80211/patches/351-0029-brcmfmac-Fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch @ 49407

Last change on this file since 49407 was 49407, checked in by rmilecki, 12 months ago

mac80211: brcmfmac: backport changes from 2016-09-27

This fixes memory leaks, some possible crashes and bug that could cause
WARNING on every add_key/del_key call. It also replaces WARNING with
a simple message. They may still occur e.g. on station going out of
range and A-MPDU stall in the firmware.

Signed-off-by: Rafał Miłecki <rafal@…>

File size: 1.2 KB
  • drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c

    From 3bdae810721b33061d2e541bd78a70f86ca42af3 Mon Sep 17 00:00:00 2001
    From: Florian Fainelli <f.fainelli@gmail.com>
    Date: Mon, 18 Jul 2016 16:24:34 -0700
    Subject: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain
    
    In case brcmf_sdiod_recv_chain() cannot complete a succeful call to
    brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we
    should, fix this.
    
    Reported-by: coverity (CID 1164856)
    Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    ---
     drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 +++-
     1 file changed, 3 insertions(+), 1 deletion(-)
    
    a b int brcmf_sdiod_recv_chain(struct brcmf_ 
    722722                        return -ENOMEM; 
    723723                err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, 
    724724                                         glom_skb); 
    725                 if (err) 
     725                if (err) { 
     726                        brcmu_pkt_buf_free_skb(glom_skb); 
    726727                        goto done; 
     728                } 
    727729 
    728730                skb_queue_walk(pktq, skb) { 
    729731                        memcpy(skb->data, glom_skb->data, skb->len); 
Note: See TracBrowser for help on using the repository browser.