brcmfmac: Fix use after free in brcmf_sdio_readframes()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 3 Dec 2019 09:58:55 +0000 (12:58 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 28 Feb 2020 14:42:16 +0000 (15:42 +0100)
commitdb15ad6f80b42c0a2d65c6989fc9ad2b3e98ff71
tree53f8485dcdddf94a7eaf963e78277863649ad881
parenta594a9e56a51295bf86959b8fdd52e6a2d67cd46
brcmfmac: Fix use after free in brcmf_sdio_readframes()

[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]

The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
    error: dereferencing freed memory 'pkt'

It looks like there was supposed to be a continue after we free "pkt".

Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c