From patchwork Wed Nov 28 14:47:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 152302 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp1178638ljp; Wed, 28 Nov 2018 06:47:56 -0800 (PST) X-Google-Smtp-Source: AJdET5dB87ivGhZrK4hg8u/43vucz8U79d7FGIOW/4Qt72cI55mkcqw+tzIM7KLvE7763RoYvdGb X-Received: by 2002:a62:5793:: with SMTP id i19mr38063746pfj.49.1543416475869; Wed, 28 Nov 2018 06:47:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543416475; cv=none; d=google.com; s=arc-20160816; b=q/J+GzPWW4f9y5jgW5BkiM0AjLuRpAe3Fq2XVdwaGKoGEviWlWbj/F8QOukazBi8JX M5SvuRLZN+GEeGW0pApCNeSVf+Fck1ePvk+NC5gTTBwHh0ZxHQu4QBwDLTeBoenWMV/B mNKCQ/M//9tfoQcrZZYAoZ6TguWU12on3CMFMXFC/hKx+nSLE89QaJejtNrVCTlSr6w9 YPlmsDUW3yv3auq85WmIYo1BQybcnEbPXAf06Fbr0veuivcjKtw8nunvIR1CI5DMlK+p IGvt4MvDjrW8If+rSx+i9nXRFgf8VHQvq9iF35j8fyp5EiwE50bD7+cz4flvKGDbz9ND D+Dg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=ib1Nmyqy8Jha56jVRFJjrt2Cum5nfJrkxYUj2wvKm48=; b=XrasmdvQ+OofDHy6Ey26FALZlOeGQM8ywnJrhs/yDyGo7EBAcH7Y/SE00eRNbcssBP MwGJBKOyrwKzTo4sUySoyLHZVjTm4RPcx/2a3gFuPQvEFCQuyLGuOLf3boeI0bTkMd/u M7XxYPIsYQ0XIe1oytOj4wA03RxsyAJTd201U8XLUq0KTc72qWBWc2BjWIfIgLWZGa+2 3h+O8yg+690690lZ1B4aHvtcONBuhTH705ZMb5rrS2kztom7jdd+NbS2Ga+Nic0lbLtF drpD2rjJHwXnSGoqR10gaIPhcJPu7xgNgbmEdFYwA/l/mDl+bWbMK6AxmZX2HGRmua8E b7BA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=b6tQYIG9; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id p64si7857277pfa.94.2018.11.28.06.47.55; Wed, 28 Nov 2018 06:47:55 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=b6tQYIG9; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728163AbeK2Btt (ORCPT + 15 others); Wed, 28 Nov 2018 20:49:49 -0500 Received: from mail-pf1-f194.google.com ([209.85.210.194]:40253 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727872AbeK2Btt (ORCPT ); Wed, 28 Nov 2018 20:49:49 -0500 Received: by mail-pf1-f194.google.com with SMTP id i12so10265251pfo.7 for ; Wed, 28 Nov 2018 06:47:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=ib1Nmyqy8Jha56jVRFJjrt2Cum5nfJrkxYUj2wvKm48=; b=b6tQYIG9rXTS8aBIIKyyzhfsGdKRKQMC04HJ8+3sTKId652EEjV6iUK7GYxInUljPT 6oncV5qGJlZxpX8rmh3zBBMdwztOqjkaFnTV+b4SKgwdqnEpgSI0KOA81E869kkRUjHI cCcqdDg2i3IievtdYKHTRjiLs2cpqOb2NpFEA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=ib1Nmyqy8Jha56jVRFJjrt2Cum5nfJrkxYUj2wvKm48=; b=ETvqOP9sHKJWaRR9g3jBC1ANJnDwmtre3ihPtkkmq7GMoOtWaDP0SDKaiCdpGLNPhz FA0kozNef7ALD55eLR/H9ekDndqaSVcvE/4ljx22wzbYYBq0j5hk6AW0I3nYoY898Qfu GFyfE1aTVIvPuiupjCC2s62t83+d6/9VilHsiZrkHL0JejFmRnwvhUXquLe2ApkF0n4z giK4X2Y9F4aoRcFm/cfd/1pCylUJon5AfMyY7gaFMA4CLW4IcGTguNI+Z4WxZsbh0CC0 1x+GcjaSUZT/DfTN/18ZHW1PNuER1KWzfR7W8hg/1itIJfAsSUFgti3kmcDbnYCZ6XXa ju5A== X-Gm-Message-State: AA+aEWb+XZJysSbTjTtn2tTnp+t/xbkc3oFgyqp76IkWzCOm8r6bMnYG LkAaCtSG1hiPuIwF59WcHoOy8w== X-Received: by 2002:a63:1f4e:: with SMTP id q14mr32179026pgm.88.1543416473946; Wed, 28 Nov 2018 06:47:53 -0800 (PST) Received: from localhost.localdomain ([49.207.53.6]) by smtp.gmail.com with ESMTPSA id r80sm14295109pfa.111.2018.11.28.06.47.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Nov 2018 06:47:52 -0800 (PST) From: Amit Pundir To: Greg KH Cc: Stable , Johannes Thumshirn , Johannes Berg , Kalle Valo Subject: [PATCH for-3.18.y 1/5] cw1200: Don't leak memory if krealloc failes Date: Wed, 28 Nov 2018 20:17:43 +0530 Message-Id: <1543416467-2081-2-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1543416467-2081-1-git-send-email-amit.pundir@linaro.org> References: <1543416467-2081-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johannes Thumshirn commit 9afdd6128c39f42398041bb2e017d8df0dcebcd1 upstream. The call to krealloc() in wsm_buf_reserve() directly assigns the newly returned memory to buf->begin. This is all fine except when krealloc() failes we loose the ability to free the old memory pointed to by buf->begin. If we just create a temporary variable to assign memory to and assign the memory to it we can mitigate the memory leak. Signed-off-by: Johannes Thumshirn Cc: Johannes Berg Signed-off-by: Kalle Valo [AmitP: Refactored to fix driver file path in linux-3.18.y] Signed-off-by: Amit Pundir --- drivers/net/wireless/cw1200/wsm.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.7.4 diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c index 9e0ca3048657..a5ac992670e8 100644 --- a/drivers/net/wireless/cw1200/wsm.c +++ b/drivers/net/wireless/cw1200/wsm.c @@ -1807,16 +1807,18 @@ static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size) { size_t pos = buf->data - buf->begin; size_t size = pos + extra_size; + u8 *tmp; size = round_up(size, FWLOAD_BLOCK_SIZE); - buf->begin = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); - if (buf->begin) { - buf->data = &buf->begin[pos]; - buf->end = &buf->begin[size]; - return 0; - } else { - buf->end = buf->data = buf->begin; + tmp = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); + if (!tmp) { + wsm_buf_deinit(buf); return -ENOMEM; } + + buf->begin = tmp; + buf->data = &buf->begin[pos]; + buf->end = &buf->begin[size]; + return 0; }