kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ath6kl: Fix potential memory leak in ath6kl_tx_complete()

Browse source 
We bail out from ath6kl_tx_complete() if any of the sanity
checks on skb and ath6kl_cookie fails. By doing this we
potentially leak few remaining buffers in packet_queue.
Make sure to proceed processing the remaining buffers
as well. This issue is found during code review.

Reported-by: Wang yufeng <yufengw@qca.qualcomm.com>
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This commit is contained in:
Vasanthakumar Thiagarajan 2012-08-14 10:10:34 +05:30 committed by Kalle Valo
parent 0616dc1f2b
commit 8114f9b6d2
1 changed files with 11 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
drivers/net/wireless/ath/ath6kl/txrx.c
View file

@ -698,21 +698,26 @@ void ath6kl_tx_complete(struct htc_target *target,
list_del(&packet->list);
ath6kl_cookie = (struct ath6kl_cookie *)packet->pkt_cntxt;
if (!ath6kl_cookie)
goto fatal;
if (WARN_ON_ONCE(!ath6kl_cookie))
continue;
status = packet->status;
skb = ath6kl_cookie->skb;
eid = packet->endpoint;
map_no = ath6kl_cookie->map_no;
if (!skb || !skb->data)
goto fatal;
if (WARN_ON_ONCE(!skb || !skb->data)) {
dev_kfree_skb(skb);
ath6kl_free_cookie(ar, ath6kl_cookie);
continue;
}
__skb_queue_tail(&skb_queue, skb);
if (!status && (packet->act_len != skb->len))
goto fatal;
if (WARN_ON_ONCE(!status && (packet->act_len != skb->len))) {
ath6kl_free_cookie(ar, ath6kl_cookie);
continue;
}
ar->tx_pending[eid]--;
@ -794,11 +799,6 @@ void ath6kl_tx_complete(struct htc_target *target,
wake_up(&ar->event_wq);
return;
fatal:
WARN_ON(1);
spin_unlock_bh(&ar->lock);
return;
}
void ath6kl_tx_data_cleanup(struct ath6kl *ar)