Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f78833e authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup() 



[ Upstream commit beb12813bc75d4a23de43b85ad1c7cb28d27631e ]

Seven years ago we tried to fix a leak but actually introduced a double
free instead.  It was an understandable mistake because the code was a
bit confusing and the free was done in the wrong place.  The "skb"
pointer is freed in both _rtl_usb_tx_urb_setup() and _rtl_usb_transmit().
The free belongs _rtl_usb_transmit() instead of _rtl_usb_tx_urb_setup()
and I've cleaned the code up a bit to hopefully make it more clear.

Fixes: 36ef0b47 ("rtlwifi: usb: add missing freeing of skbuff")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200513093951.GD347693@mwanda


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 9e9b57c4

drivers/net/wireless/realtek/rtlwifi/usb.c

+2 −6
Original line number Diff line number Diff line
@@ -927,10 +927,8 @@ static struct urb *_rtl_usb_tx_urb_setup(struct ieee80211_hw *hw, 


	WARN_ON(NULL == skb);

	_urb = usb_alloc_urb(0, GFP_ATOMIC);

	if (!_urb) {

		kfree_skb(skb);

	if (!_urb)

		return NULL;

	}

	_rtl_install_trx_info(rtlusb, skb, ep_num);

	usb_fill_bulk_urb(_urb, rtlusb->udev, usb_sndbulkpipe(rtlusb->udev,

			  ep_num), skb->data, skb->len, _rtl_tx_complete, skb);
@@ -945,7 +943,6 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb, 
	struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw));

	u32 ep_num;

	struct urb *_urb = NULL;

	struct sk_buff *_skb = NULL;



	WARN_ON(NULL == rtlusb->usb_tx_aggregate_hdl);

	if (unlikely(IS_USB_STOP(rtlusb))) {
@@ -955,8 +952,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb, 
		return;

	}

	ep_num = rtlusb->ep_map.ep_mapping[qnum];

	_skb = skb;

	_urb = _rtl_usb_tx_urb_setup(hw, _skb, ep_num);

	_urb = _rtl_usb_tx_urb_setup(hw, skb, ep_num);

	if (unlikely(!_urb)) {

		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,

			 "Can't allocate urb. Drop skb!\n");