Messages in this thread | | | From | "Liu, Chuansheng" <> | Subject | RE: [PATCH] [staging][r8188eu]: memory leak in rtw_free_cmd_obj if command is (_Set_Drv_Extra) | Date | Mon, 10 Mar 2014 01:44:59 +0000 |
| |
Hi,
> -----Original Message----- > From: Wang, Xiaoming > Sent: Monday, March 10, 2014 11:38 PM > To: gregkh@linuxfoundation.org; valentina.manea.m@gmail.com; > dan.carpenter@oracle.com; standby24x7@gmail.com > Cc: devel@driverdev.osuosl.org; linux-kernel@vger.kernel.org; Zhang, > Dongxing; Wang, Xiaoming; Liu, Chuansheng > Subject: [PATCH] [staging][r8188eu]: memory leak in rtw_free_cmd_obj if > command is (_Set_Drv_Extra) > > pcmd->parmbuf->pbuf has been allocated if command is > GEN_CMD_CODE(_Set_Drv_Extra), > and it enqueued by rtw_enqueue_cmd. rtw_cmd_thread dequeue pcmd by > rtw_dequeue_cmd. > The memory leak happened on this branch "if( _FAIL == > rtw_cmd_filter(pcmdpriv, pcmd) )" > which goto post_process directly against freeing pcmd->parmbuf->pbuf in > rtw_drvextra_cmd_hdl which is the cmd_hdl if command is (_Set_Drv_Extra). > This patch free pcmd->parmbuf->pbuf on the forgotten branch to avoid memory > leak. > > Signed-off-by: Zhang Dongxing <dongxing.zhang@intel.com> > Signed-off-by: xiaoming wang <xiaoming.wang@intel.com> > > diff --git a/drivers/staging/rtl8188eu/core/rtw_cmd.c > b/drivers/staging/rtl8188eu/core/rtw_cmd.c > index c0a0a52..1c7f505 100644 > --- a/drivers/staging/rtl8188eu/core/rtw_cmd.c > +++ b/drivers/staging/rtl8188eu/core/rtw_cmd.c > @@ -288,7 +288,7 @@ int rtw_cmd_thread(void *context) > void (*pcmd_callback)(struct adapter *dev, struct cmd_obj *pcmd); > struct adapter *padapter = (struct adapter *)context; > struct cmd_priv *pcmdpriv = &(padapter->cmdpriv); > - > + struct drvextra_cmd_parm *extra_parm = NULL; > > thread_enter("RTW_CMD_THREAD"); > > @@ -323,6 +323,11 @@ _next: > > if (_FAIL == rtw_cmd_filter(pcmdpriv, pcmd)) { > pcmd->res = H2C_DROPPED; > + if (pcmd->cmdcode == > GEN_CMD_CODE(_Set_Drv_Extra)) { > + extra_parm = (struct > drvextra_cmd_parm *)pcmd->parmbuf; > + if (extra_parm && extra_parm->pbuf > && extra_parm->size > 0) > + rtw_mfree(extra_parm->pbuf, > extra_parm->size); > + } > goto post_process; > } >
Reviewed-by: Chuansheng Liu <chuansheng.liu@intel.com>
Thanks.
Best Regards Chuansheng
| |