From patchwork Tue May 26 13:34:28 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amitkumar Karwar X-Patchwork-Id: 6481261 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id B0962C0020 for ; Tue, 26 May 2015 13:35:34 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EBB75202F0 for ; Tue, 26 May 2015 13:35:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 013C52042A for ; Tue, 26 May 2015 13:35:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754919AbbEZNfb (ORCPT ); Tue, 26 May 2015 09:35:31 -0400 Received: from mx0b-0016f401.pphosted.com ([67.231.156.173]:62789 "EHLO mx0b-0016f401.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754912AbbEZNf1 (ORCPT ); Tue, 26 May 2015 09:35:27 -0400 Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.14.5/8.14.5) with SMTP id t4QDYpH7003451 for ; Tue, 26 May 2015 06:35:23 -0700 Received: from sc-owa.marvell.com ([199.233.58.135]) by mx0b-0016f401.pphosted.com with ESMTP id 1umqg00bpw-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for ; Tue, 26 May 2015 06:35:23 -0700 Received: from maili.marvell.com (10.93.76.83) by SC-OWA.marvell.com (10.93.76.28) with Microsoft SMTP Server id 8.3.327.1; Tue, 26 May 2015 06:35:11 -0700 Received: from pe-lt101 (unknown [10.31.130.205]) by maili.marvell.com (Postfix) with ESMTP id 82B5D3F7040; Tue, 26 May 2015 06:35:11 -0700 (PDT) Received: from pe-lt101 (pe-lt077 [127.0.0.1]) by pe-lt101 (8.14.4/8.14.4) with ESMTP id t4QDYmCg005781; Tue, 26 May 2015 06:34:49 -0700 Received: (from root@localhost) by pe-lt101 (8.14.4/8.14.4/Submit) id t4QDYmX0005780; Tue, 26 May 2015 06:34:48 -0700 From: Amitkumar Karwar To: CC: Cathy Luo , Avinash Patil , Amitkumar Karwar Subject: [PATCH 2/6] mwifiex: fix a possible double free issue Date: Tue, 26 May 2015 06:34:28 -0700 Message-ID: <1432647272-5734-3-git-send-email-akarwar@marvell.com> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1432647272-5734-1-git-send-email-akarwar@marvell.com> References: <1432647272-5734-1-git-send-email-akarwar@marvell.com> MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.14.151, 1.0.33, 0.0.0000 definitions=2015-05-26_02:2015-05-26, 2015-05-26, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1505260177 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP As drv_info_dump pointer doesn't get reset, we may end up freeing the allocated memory twice. Signed-off-by: Amitkumar Karwar Signed-off-by: Cathy Luo --- drivers/net/wireless/mwifiex/init.c | 1 + drivers/net/wireless/mwifiex/main.c | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c index fdf38d0..df7fdc0 100644 --- a/drivers/net/wireless/mwifiex/init.c +++ b/drivers/net/wireless/mwifiex/init.c @@ -435,6 +435,7 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter) if (adapter->drv_info_dump) { vfree(adapter->drv_info_dump); + adapter->drv_info_dump = NULL; adapter->drv_info_size = 0; } diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c index 138c1cc..cb009789 100644 --- a/drivers/net/wireless/mwifiex/main.c +++ b/drivers/net/wireless/mwifiex/main.c @@ -886,6 +886,7 @@ void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter) if (adapter->drv_info_dump) { vfree(adapter->drv_info_dump); + adapter->drv_info_dump = NULL; adapter->drv_info_size = 0; }