Commit 3bdae810 authored Jul 18, 2016 by Florian Fainelli Committed by Kalle Valo Jul 19, 2016

brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain



In case brcmf_sdiod_recv_chain() cannot complete a succeful call to
brcmf_sdiod_buffrw, we would be leaking glom_skb and not free it as we
should, fix this.

Reported-by: coverity (CID 1164856)
Fixes: a413e39a ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

parent cc2d1de0

drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
		return -ENOMEM;
		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
		glom_skb);
		if (err)
		if (err) {
		brcmu_pkt_buf_free_skb(glom_skb);
		goto done;
		}

		skb_queue_walk(pktq, skb) {
		memcpy(skb->data, glom_skb->data, skb->len);