netdev - [PATCH v2] brcmfmac: Fix memory leak for unpaired brcmf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Oct 2020 10:52:47 +0900
From:   Seung-Woo Kim <sw0312.kim@...sung.com>
To:     arend.vanspriel@...adcom.com, franky.lin@...adcom.com,
        hante.meuleman@...adcom.com, chi-hsien.lin@...ress.com,
        wright.feng@...ress.com, kvalo@...eaurora.org, davem@...emloft.net,
        kuba@...nel.org, linux-wireless@...r.kernel.org,
        brcm80211-dev-list.pdl@...adcom.com, brcm80211-dev-list@...ress.com
Cc:     smoch@....de, sandals@...stytoothpaste.net, rafal@...ecki.pl,
        digetx@...il.com, double.lo@...ress.com, amsr@...ress.com,
        stanley.hsu@...ress.com, saravanan.shanmugham@...ress.com,
        jean-philippe@...aro.org, frank.kao@...ress.com,
        netdev@...r.kernel.org, sw0312.kim@...sung.com,
        jh80.chung@...sung.com
Subject: [PATCH v2] brcmfmac: Fix memory leak for unpaired
 brcmf_{alloc/free}

There are missig brcmf_free() for brcmf_alloc(). Fix memory leak
by adding missed brcmf_free().

Reported-by: Jaehoon Chung <jh80.chung@...sung.com>
Fixes: commit 450914c39f88 ("brcmfmac: split brcmf_attach() and brcmf_detach() functions")
Signed-off-by: Seung-Woo Kim <sw0312.kim@...sung.com>
Reviewed-by: Arend van Spriel <arend.vanspriel@...adcom.com>
---
Change from v1 [1]
- add Fixes tag for the commit creating brcmf_alloc/free and unpaired path
- add Reviewd-by tag from Arend

[1] https://lore.kernel.org/linux-wireless/1603795630-14638-1-git-send-email-sw0312.kim@samsung.com/
---
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |    6 ++++--
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |    1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index 39381cb..d8db0db 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -1936,16 +1936,18 @@ static void brcmf_pcie_setup(struct device *dev, int ret,
 	fwreq = brcmf_pcie_prepare_fw_request(devinfo);
 	if (!fwreq) {
 		ret = -ENOMEM;
-		goto fail_bus;
+		goto fail_brcmf;
 	}
 
 	ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup);
 	if (ret < 0) {
 		kfree(fwreq);
-		goto fail_bus;
+		goto fail_brcmf;
 	}
 	return 0;
 
+fail_brcmf:
+	brcmf_free(&devinfo->pdev->dev);
 fail_bus:
 	kfree(bus->msgbuf);
 	kfree(bus);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 99987a7..59c2b2b 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4541,6 +4541,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
 		brcmf_sdiod_intr_unregister(bus->sdiodev);
 
 		brcmf_detach(bus->sdiodev->dev);
+		brcmf_free(bus->sdiodev->dev);
 
 		cancel_work_sync(&bus->datawork);
 		if (bus->brcmf_wq)
-- 
1.7.4.1