lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.8 310/633] mwifiex: fix double free
    Date
    From: Tom Rix <trix@redhat.com>

    [ Upstream commit 53708f4fd9cfe389beab5c8daa763bcd0e0b4aef ]

    clang static analysis reports this problem:

    sdio.c:2403:3: warning: Attempt to free released memory
    kfree(card->mpa_rx.buf);
    ^~~~~~~~~~~~~~~~~~~~~~~

    When mwifiex_init_sdio() fails in its first call to
    mwifiex_alloc_sdio_mpa_buffer, it falls back to calling it
    again. If the second alloc of mpa_tx.buf fails, the error
    handler will try to free the old, previously freed mpa_rx.buf.
    Reviewing the code, it looks like a second double free would
    happen with mwifiex_cleanup_sdio().

    So set both pointers to NULL when they are freed.

    Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
    Signed-off-by: Tom Rix <trix@redhat.com>
    Reviewed-by: Brian Norris <briannorris@chromium.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20201004131931.29782-1-trix@redhat.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/marvell/mwifiex/sdio.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
    index a042965962a2d..1b6bee5465288 100644
    --- a/drivers/net/wireless/marvell/mwifiex/sdio.c
    +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
    @@ -1976,6 +1976,8 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter,
    kfree(card->mpa_rx.buf);
    card->mpa_tx.buf_size = 0;
    card->mpa_rx.buf_size = 0;
    + card->mpa_tx.buf = NULL;
    + card->mpa_rx.buf = NULL;
    }

    return ret;
    --
    2.25.1


    \
     
     \ /
      Last update: 2022-09-17 16:09    [W:4.355 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site