소스 검색

ath10k: prevent memory leak in wmi rx ops

Found during code review. This was pretty much
impossible to happen but better safe than sorry.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Michal Kazior 10 년 전
부모
커밋
469d479f91
2개의 변경된 파일7개의 추가작업 그리고 4개의 파일을 삭제
  1. 2 1
      drivers/net/wireless/ath/ath10k/wmi-tlv.c
  2. 5 3
      drivers/net/wireless/ath/ath10k/wmi.c

+ 2 - 1
drivers/net/wireless/ath/ath10k/wmi-tlv.c

@@ -402,7 +402,7 @@ static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 
 
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
-		return;
+		goto out;
 
 
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 
 
@@ -521,6 +521,7 @@ static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
 		break;
 		break;
 	}
 	}
 
 
+out:
 	dev_kfree_skb(skb);
 	dev_kfree_skb(skb);
 }
 }
 
 

+ 5 - 3
drivers/net/wireless/ath/ath10k/wmi.c

@@ -3223,7 +3223,7 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 
 
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
-		return;
+		goto out;
 
 
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 
 
@@ -3327,6 +3327,7 @@ static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
 		break;
 		break;
 	}
 	}
 
 
+out:
 	dev_kfree_skb(skb);
 	dev_kfree_skb(skb);
 }
 }
 
 
@@ -3340,7 +3341,7 @@ static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 
 
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
-		return;
+		goto out;
 
 
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 
 
@@ -3463,7 +3464,7 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 	id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
 
 
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
 	if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
-		return;
+		goto out;
 
 
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 	trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
 
 
@@ -3571,6 +3572,7 @@ static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
 		break;
 		break;
 	}
 	}
 
 
+out:
 	dev_kfree_skb(skb);
 	dev_kfree_skb(skb);
 }
 }