diff options
| author | Lorenzo Bianconi <lorenzo.bianconi@redhat.com> | 2019-02-10 22:49:14 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2019-02-18 19:55:50 +0100 |
| commit | cb83585e1121bd6d6c039cf09fa32380bf8b6258 (patch) | |
| tree | e5b99c17950e303e3a26a7ad1fafb045befb86c0 /drivers/net/wireless/mediatek/mt76 | |
| parent | mt76: usb: fix possible NULL pointer dereference in mt76u_mcu_deinit (diff) | |
| download | linux-cb83585e1121bd6d6c039cf09fa32380bf8b6258.tar.xz linux-cb83585e1121bd6d6c039cf09fa32380bf8b6258.zip | |
mt76: usb: fix possible memory leak in mt76u_buf_free
Move q->ndesc initialization before the for loop in mt76u_alloc_rx
since otherwise allocated urbs will not be freed in mt76u_buf_free
Double-check scatterlist pointer in mt76u_buf_free
Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to '')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/usb.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c index 018a8cf0941e..aee5ff124055 100644 --- a/drivers/net/wireless/mediatek/mt76/usb.c +++ b/drivers/net/wireless/mediatek/mt76/usb.c @@ -330,10 +330,16 @@ int mt76u_buf_alloc(struct mt76_dev *dev, struct mt76u_buf *buf, void mt76u_buf_free(struct mt76u_buf *buf) { struct urb *urb = buf->urb; + struct scatterlist *sg; int i; - for (i = 0; i < urb->num_sgs; i++) - skb_free_frag(sg_virt(&urb->sg[i])); + for (i = 0; i < urb->num_sgs; i++) { + sg = &urb->sg[i]; + if (!sg) + continue; + + skb_free_frag(sg_virt(sg)); + } usb_free_urb(buf->urb); } EXPORT_SYMBOL_GPL(mt76u_buf_free); @@ -537,7 +543,8 @@ static int mt76u_alloc_rx(struct mt76_dev *dev) nsgs = 1; } - for (i = 0; i < MT_NUM_RX_ENTRIES; i++) { + q->ndesc = MT_NUM_RX_ENTRIES; + for (i = 0; i < q->ndesc; i++) { err = mt76u_buf_alloc(dev, &q->entry[i].ubuf, nsgs, q->buf_size, SKB_WITH_OVERHEAD(q->buf_size), @@ -545,7 +552,6 @@ static int mt76u_alloc_rx(struct mt76_dev *dev) if (err < 0) return err; } - q->ndesc = MT_NUM_RX_ENTRIES; return mt76u_submit_rx_buffers(dev); } |