brcmfmac: Fix use after free in brcmf_sdio_readframes()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 3 Dec 2019 09:58:55 +0000 (12:58 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 Feb 2020 07:36:24 +0000 (08:36 +0100)
commit071963d3714301c7b14c8e71200d9bf5c30925ce
tree7944d5092b23fd362c90ce8d654b51ee4747018a
parent55195593a8c6b12450d36670c9b9d0b7bc974e83
brcmfmac: Fix use after free in brcmf_sdio_readframes()

[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]

The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
    error: dereferencing freed memory 'pkt'

It looks like there was supposed to be a continue after we free "pkt".

Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c