lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 811/917] can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path
    Date
    From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>

    [ Upstream commit d9447f768bc8c60623e4bb3ce65b8f4654d33a50 ]

    In es58x_rx_err_msg(), if can->do_set_mode() fails, the function
    directly returns without calling netif_rx(skb). This means that the
    skb previously allocated by alloc_can_err_skb() is not freed. In other
    terms, this is a memory leak.

    This patch simply removes the return statement in the error branch and
    let the function continue.

    Issue was found with GCC -fanalyzer, please follow the link below for
    details.

    Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
    Link: https://lore.kernel.org/all/20211026180740.1953265-1-mailhol.vincent@wanadoo.fr
    Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/can/usb/etas_es58x/es58x_core.c | 6 ++----
    1 file changed, 2 insertions(+), 4 deletions(-)

    diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
    index 96a13c770e4a1..24627ab146261 100644
    --- a/drivers/net/can/usb/etas_es58x/es58x_core.c
    +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
    @@ -664,7 +664,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error,
    struct can_device_stats *can_stats = &can->can_stats;
    struct can_frame *cf = NULL;
    struct sk_buff *skb;
    - int ret;
    + int ret = 0;

    if (!netif_running(netdev)) {
    if (net_ratelimit())
    @@ -823,8 +823,6 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error,
    can->state = CAN_STATE_BUS_OFF;
    can_bus_off(netdev);
    ret = can->do_set_mode(netdev, CAN_MODE_STOP);
    - if (ret)
    - return ret;
    }
    break;

    @@ -881,7 +879,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error,
    ES58X_EVENT_BUSOFF, timestamp);
    }

    - return 0;
    + return ret;
    }

    /**
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 01:02    [W:3.033 / U:0.252 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site