package/kernel/mac80211/patches/351-0029-brcmfmac-Fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch

   1 From 3bdae810721b33061d2e541bd78a70f86ca42af3 Mon Sep 17 00:00:00 2001
   2 From: Florian Fainelli <f.fainelli@gmail.com>
   3 Date: Mon, 18 Jul 2016 16:24:34 -0700
   4 Subject: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain
   5
   6 In case brcmf_sdiod_recv_chain() cannot complete a succeful call to
   7 brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we
   8 should, fix this.
   9
  10 Reported-by: coverity (CID 1164856)
  11 Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")
  12 Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
  13 Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  14 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  15 ---
  16  drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 4 +++-
  17  1 file changed, 3 insertions(+), 1 deletion(-)
  18
  19 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
  20 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
  21 @@ -722,8 +722,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_
  22                         return -ENOMEM;
  23                 err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
  24                                          glom_skb);
  25 -               if (err)
  26 +               if (err) {
  27 +                       brcmu_pkt_buf_free_skb(glom_skb);
  28                         goto done;
  29 +               }
  30
  31                 skb_queue_walk(pktq, skb) {
  32                         memcpy(skb->data, glom_skb->data, skb->len);