lkml.org 
[lkml]   [2022]   [Mar]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH 2/2] staging: r8188eu: fix potential memory leak in _rtw_init_xmit_priv()
On Wed, Mar 30, 2022 at 11:29:22PM +0800, xkernel.wang@foxmail.com wrote:
> @@ -134,7 +134,12 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
> msleep(10);
> res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ));
> if (res == _FAIL) {
> - goto exit;
> + pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
> + for (; i >= 0; i--) {

This frees one more element than you intended. It should be:

while (--i >= 0) {

> + rtw_os_xmit_resource_free(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ));
> + pxmitbuf++;
> + }
> + goto free_xmitbuf;
> }
> }
>
> @@ -153,7 +158,7 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
>
> if (!pxmitpriv->pallocated_xmit_extbuf) {
> res = _FAIL;
> - goto exit;
> + goto free_pxmitbuf;
> }
>
> pxmitpriv->pxmit_extbuf = (u8 *)N_BYTE_ALIGMENT((size_t)(pxmitpriv->pallocated_xmit_extbuf), 4);
> @@ -169,8 +174,12 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter)
>
> res = rtw_os_xmit_resource_alloc(padapter, pxmitbuf, max_xmit_extbuf_size + XMITBUF_ALIGN_SZ);
> if (res == _FAIL) {
> - res = _FAIL;
> - goto exit;
> + pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
> + for (; i >= 0; i--) {

Same thing here.

> + rtw_os_xmit_resource_free(padapter, pxmitbuf, (max_xmit_extbuf_size + XMITBUF_ALIGN_SZ));
> + pxmitbuf++;
> + }
> + goto free_xmit_extbuf;
> }
>
> list_add_tail(&pxmitbuf->list, &pxmitpriv->free_xmit_extbuf_queue.queue);

[ snip ]

> diff --git a/drivers/staging/r8188eu/os_dep/xmit_linux.c b/drivers/staging/r8188eu/os_dep/xmit_linux.c
> index 565ac5b..7aa39b5 100644
> --- a/drivers/staging/r8188eu/os_dep/xmit_linux.c
> +++ b/drivers/staging/r8188eu/os_dep/xmit_linux.c
> @@ -95,8 +95,14 @@ void rtw_os_xmit_resource_free(struct adapter *padapter,
> {
> int i;
>
> - for (i = 0; i < 8; i++)
> + if (!pxmitbuf->pallocated_buf)
> + return;
> +
> + for (i = 0; i < 8; i++) {
> + if (!pxmitbuf->pxmit_urb[i])
> + break;
> usb_free_urb(pxmitbuf->pxmit_urb[i]);
> + }
>
> kfree(pxmitbuf->pallocated_buf);

No need to modify rtw_os_xmit_resource_free(). Passing a NULL to
usb_free_urb() or kfree() is a no op.

regards,
dan carpenter

\
 
 \ /
  Last update: 2022-03-31 09:38    [W:0.070 / U:0.936 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site