Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ead1cee8 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

brcmfmac: Fix use after free in brcmf_sdio_readframes() 



[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]

The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
    error: dereferencing freed memory 'pkt'

It looks like there was supposed to be a continue after we free "pkt".

Fixes: 4754fcee ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarFranky Lin <franky.lin@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent b9dc4d61

drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c

+1 −0
Original line number Diff line number Diff line
@@ -1934,6 +1934,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes) 
					       BRCMF_SDIO_FT_NORMAL)) {

				rd->len = 0;

				brcmu_pkt_buf_free_skb(pkt);

				continue;

			}

			bus->sdcnt.rx_readahead_cnt++;

			if (rd->len != roundup(rd_new.len, 16)) {