| Message ID | 1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 212fde3fe76e962598ce1d47b97cc78afdfc71b3 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [wireless,v2] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() | expand |
On 11/17/2022 12:33 PM, 'Zhang Changzhong' via BRCM80211-DEV-LIST,PDL wrote: > The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb > in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. > Compile tested only. > > Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> > Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> > --- > v1->v2: add "Compile tested only" to commit log > > drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + > 1 file changed, 1 insertion(+)
Zhang Changzhong <zhangchangzhong@huawei.com> wrote: > The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb > in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. > Compile tested only. > > Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") > Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> > Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Patch applied to wireless-next.git, thanks. 212fde3fe76e wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 595ae3a..175272c 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -335,6 +335,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, bphy_err(drvr, "%s: failed to expand headroom\n", brcmf_ifname(ifp)); atomic_inc(&drvr->bus_if->stats.pktcow_failed); + dev_kfree_skb(skb); goto done; } }
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only. Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- v1->v2: add "Compile tested only" to commit log drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + 1 file changed, 1 insertion(+)