From patchwork Wed Nov 28 17:29:01 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 152339 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp1365680ljp; Wed, 28 Nov 2018 09:30:04 -0800 (PST) X-Google-Smtp-Source: AFSGD/XtO9yxWAxIVhJQjv+Td7GywF8KYIedND3U808TKkt/P+l/tGWb2yoDV+UTPYFWXK4gfe/X X-Received: by 2002:a17:902:f01:: with SMTP id 1mr33520928ply.143.1543426203933; Wed, 28 Nov 2018 09:30:03 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1543426203; cv=none; d=google.com; s=arc-20160816; b=xdydzpAYDxsUhxcjTmBECOa03DShLR02KSFk0fcXAQ4kg059KmXOA/OJdAi2PfsYaP gWPOr+2iNXnfxy/qJgKEvSPXyKZWHdicw0tWarUlQwJ+Is8q3Bpvkw7bY/ItphRPd2EE vfopfRWLNW/3RadT7Qy9Cx1V0VK/KrhFQ6eGcyD/E8boVIgDqW3idfuUPBTyw2vsRy0K zXBR4UPjqqEfWFa+1HuwGnAx7xoRImctVwNAfnSN4mdn+O6tCcjc2XXZAVEWNo9JUPv9 ljCNDb2LN1uBN7GxufNgxVmx5WDY3WkxJG3LcQzawa8LaY2Wy8DfVqUJyjwVDp4whMSd ZMTw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature; bh=hoskUs06Z7Cn4GIR2unwyyDYZ5YY9jhp9H+S4bJ6pbo=; b=MnyQ0kCzjDfL/M1Y9nfEj6M3QmXVq+mNKVQtQaCaw4IIwaDvynlm/qKFhNmokL48Om Fl56Ots48ajoH3FWZlRxunealkSDa+f7DCbtUmkwYzptbPgwkiDXn7UnGQ/03QkiGMlb tHKDV5DFRLCWcsaU8rI8d420FPPK/osQZPYTeKbT2FlYhc67xlMczgx98Qz1lgIgfrZW plYej2dz7Op37ol4Y9jctRyDqd5RYPvpJ38ooLHDDTniQPL9HC4iWbGUhR1UQdDPYFe5 3sPN9FvLBq+5arZk7nDDh7hfDYTrOqaCwJ8Kyhi2rrGJ3tlQtMAhBYj970T5juEO1sNI 2FvQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=eJ67b21K; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 44si8357481plb.57.2018.11.28.09.30.01; Wed, 28 Nov 2018 09:30:03 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=eJ67b21K; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728446AbeK2Ebm (ORCPT + 15 others); Wed, 28 Nov 2018 23:31:42 -0500 Received: from mail-pl1-f195.google.com ([209.85.214.195]:42090 "EHLO mail-pl1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728654AbeK2Ebl (ORCPT ); Wed, 28 Nov 2018 23:31:41 -0500 Received: by mail-pl1-f195.google.com with SMTP id x21-v6so17697338pln.9 for ; Wed, 28 Nov 2018 09:29:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=hoskUs06Z7Cn4GIR2unwyyDYZ5YY9jhp9H+S4bJ6pbo=; b=eJ67b21KR4X5djMVW+BdjD3jBYiiJrYBg61j7D7szmJOd4WHpIoOrUVxvGNGCyLBRR gau8MbN5cgW/C/HJRtt5F0xPX0GYhQPXX+qvxLKDlxYBekn1u2sPj5sn/ayHZiqS9bUL ljezB5Dofl4P/8Mm39VWdoIc/irHsUKx6LBxI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=hoskUs06Z7Cn4GIR2unwyyDYZ5YY9jhp9H+S4bJ6pbo=; b=cUzj4lLq/CqpBBn5l+AKLbg6tQyztADNcYIN0REhdDERotyNKzRauKZv7POULFmTqA CD/X8+LSbMXSjUluQAJM33088drsvi4/DsMc5Fm7fytZZVsBJ5DCMeyNqRwiAnuwujJG XA30+kkll+d0ZF4NDKLxdYazOZOAU21GQXomOr+yB4xC2wuiK5VKyhNObCO6txsMJHpS 0ASyPxVhqCMV18P9qibvSX1r0x2T0X5dbhEvvIezmokXJuJBDn2kdzuNryNfqK0HAHWl 6fv3Gyrw5opilFwWTmjlVWNXHvIXNrfeuOV6BFKux1PUXR4x7sM6H4dqOUIGzMHtEJ+N 10/Q== X-Gm-Message-State: AA+aEWan8katRaFVFHNLKpwxvI++/YZYk2mmpFfeeFYsBgdSqBEGZx3x jU3eumgVm04m9Vh03IhHNUNqoA== X-Received: by 2002:a17:902:2904:: with SMTP id g4mr37546854plb.39.1543426158697; Wed, 28 Nov 2018 09:29:18 -0800 (PST) Received: from localhost.localdomain ([49.207.53.6]) by smtp.gmail.com with ESMTPSA id 84sm13624360pfk.134.2018.11.28.09.29.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 28 Nov 2018 09:29:17 -0800 (PST) From: Amit Pundir To: Greg KH Cc: Stable , Johannes Thumshirn , Johannes Berg , Kalle Valo Subject: [PATCH for-4.4.y 02/10] cw1200: Don't leak memory if krealloc failes Date: Wed, 28 Nov 2018 22:59:01 +0530 Message-Id: <1543426149-7269-3-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1543426149-7269-1-git-send-email-amit.pundir@linaro.org> References: <1543426149-7269-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johannes Thumshirn commit 9afdd6128c39f42398041bb2e017d8df0dcebcd1 upstream. The call to krealloc() in wsm_buf_reserve() directly assigns the newly returned memory to buf->begin. This is all fine except when krealloc() failes we loose the ability to free the old memory pointed to by buf->begin. If we just create a temporary variable to assign memory to and assign the memory to it we can mitigate the memory leak. Signed-off-by: Johannes Thumshirn Cc: Johannes Berg Signed-off-by: Kalle Valo [AmitP: Refactored to fix driver file path in linux-4.4.y] Signed-off-by: Amit Pundir --- drivers/net/wireless/cw1200/wsm.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.7.4 diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c index 3dd46c78c1cc..5a595f9f47ff 100644 --- a/drivers/net/wireless/cw1200/wsm.c +++ b/drivers/net/wireless/cw1200/wsm.c @@ -1805,16 +1805,18 @@ static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size) { size_t pos = buf->data - buf->begin; size_t size = pos + extra_size; + u8 *tmp; size = round_up(size, FWLOAD_BLOCK_SIZE); - buf->begin = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); - if (buf->begin) { - buf->data = &buf->begin[pos]; - buf->end = &buf->begin[size]; - return 0; - } else { - buf->end = buf->data = buf->begin; + tmp = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA); + if (!tmp) { + wsm_buf_deinit(buf); return -ENOMEM; } + + buf->begin = tmp; + buf->data = &buf->begin[pos]; + buf->end = &buf->begin[size]; + return 0; }