diff options
Diffstat (limited to 'package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch')
-rw-r--r-- | package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch b/package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch new file mode 100644 index 0000000000..a9a9d74c10 --- /dev/null +++ b/package/kernel/mac80211/patches/brcm/368-v5.2-brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch @@ -0,0 +1,41 @@ +From a927e8d8ab57e696800e20cf09a72b7dfe3bbebb Mon Sep 17 00:00:00 2001 +From: Colin Ian King <colin.king@canonical.com> +Date: Tue, 9 Apr 2019 12:43:33 +0100 +Subject: [PATCH] brcmfmac: fix leak of mypkt on error return path + +Currently if the call to brcmf_sdiod_set_backplane_window fails then +error return path leaks mypkt. Fix this by returning by a new +error path labelled 'out' that calls brcmu_pkt_buf_free_skb to free +mypkt. Also remove redundant check on err before calling +brcmf_sdiod_skbuff_write. + +Addresses-Coverity: ("Resource Leak") +Fixes: a7c3aa1509e2 ("brcmfmac: Remove brcmf_sdiod_addrprep()") +Signed-off-by: Colin Ian King <colin.king@canonical.com> +Reviewed-by: Mukesh Ojha <mojha@codeaurora.org> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sd + + err = brcmf_sdiod_set_backplane_window(sdiodev, addr); + if (err) +- return err; ++ goto out; + + addr &= SBSDIO_SB_OFT_ADDR_MASK; + addr |= SBSDIO_SB_ACCESS_2_4B_FLAG; + +- if (!err) +- err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, +- mypkt); +- ++ err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt); ++out: + brcmu_pkt_buf_free_skb(mypkt); + + return err; |