@@ -402,7 +402,7 @@ static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
- return;
+ goto out;
trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
@@ -521,6 +521,7 @@ static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
break;
}
+out:
dev_kfree_skb(skb);
}
@@ -3222,7 +3222,7 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
- return;
+ goto out;
trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
@@ -3326,6 +3326,7 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
break;
}
+out:
dev_kfree_skb(skb);
}
@@ -3339,7 +3340,7 @@ static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
- return;
+ goto out;
trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
@@ -3462,7 +3463,7 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
- return;
+ goto out;
trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
@@ -3570,6 +3571,7 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
break;
}
+out:
dev_kfree_skb(skb);
}
Found during code review. This was pretty much impossible to happen but better safe than sorry. Signed-off-by: Michal Kazior <michal.kazior@tieto.com> --- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 ++- drivers/net/wireless/ath/ath10k/wmi.c | 8 +++++--- 2 files changed, 7 insertions(+), 4 deletions(-)