Browse Source

brcmfmac: fix memory leak in brcmf_flowring_add_tdls_peer()

In the error paths in brcmf_flowring_add_tdls_peer() the allocated
resource should be freed.

Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Arend Van Spriel 9 years ago
parent
commit
bc98164136
1 changed files with 6 additions and 2 deletions
  1. 6 2
      drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c

+ 6 - 2
drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c

@@ -495,14 +495,18 @@ void brcmf_flowring_add_tdls_peer(struct brcmf_flowring *flow, int ifidx,
 	} else {
 	} else {
 		search = flow->tdls_entry;
 		search = flow->tdls_entry;
 		if (memcmp(search->mac, peer, ETH_ALEN) == 0)
 		if (memcmp(search->mac, peer, ETH_ALEN) == 0)
-			return;
+			goto free_entry;
 		while (search->next) {
 		while (search->next) {
 			search = search->next;
 			search = search->next;
 			if (memcmp(search->mac, peer, ETH_ALEN) == 0)
 			if (memcmp(search->mac, peer, ETH_ALEN) == 0)
-				return;
+				goto free_entry;
 		}
 		}
 		search->next = tdls_entry;
 		search->next = tdls_entry;
 	}
 	}
 
 
 	flow->tdls_active = true;
 	flow->tdls_active = true;
+	return;
+
+free_entry:
+	kfree(tdls_entry);
 }
 }