From: Dave Jones Date: Thu, 6 Mar 2014 20:51:08 +0000 (-0500) Subject: brcmfmac: fix skb leak in brcmf_sdio_txpkt_prep_sg error path. X-Git-Tag: v4.9.8~6747^2~21^2^2~3 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=2dc3a8e0b6e10c77798a4f6f711ce66334eda1c4;p=platform%2Fkernel%2Flinux-rpi3.git brcmfmac: fix skb leak in brcmf_sdio_txpkt_prep_sg error path. Commit 1eb4301867 (brcmfmac: fix txglomming scatter-gather packet transfers) added an allocation of an skb via brcmu_pkt_buf_get_skb() but forgot to free it on one of the error paths. Acked-by: Arend van Spriel Signed-off-by: Dave Jones Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c index 119ee6e..ddaa9ef 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c @@ -1948,8 +1948,10 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus, if (pkt_pad == NULL) return -ENOMEM; ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad); - if (unlikely(ret < 0)) + if (unlikely(ret < 0)) { + kfree_skb(pkt_pad); return ret; + } memcpy(pkt_pad->data, pkt->data + pkt->len - tail_chop, tail_chop);