mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-16 07:35:14 +00:00
mt76: usb: fix possible memory leak in mt76u_buf_free
[ Upstream commitcb83585e11
] Move q->ndesc initialization before the for loop in mt76u_alloc_rx since otherwise allocated urbs will not be freed in mt76u_buf_free Double-check scatterlist pointer in mt76u_buf_free Fixes:b40b15e152
("mt76: add usb support to mt76 layer") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Signed-off-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4738e916fb
commit
379ba92895
1 changed files with 10 additions and 4 deletions
|
@ -273,10 +273,16 @@ EXPORT_SYMBOL_GPL(mt76u_buf_alloc);
|
|||
void mt76u_buf_free(struct mt76u_buf *buf)
|
||||
{
|
||||
struct urb *urb = buf->urb;
|
||||
struct scatterlist *sg;
|
||||
int i;
|
||||
|
||||
for (i = 0; i < urb->num_sgs; i++)
|
||||
skb_free_frag(sg_virt(&urb->sg[i]));
|
||||
for (i = 0; i < urb->num_sgs; i++) {
|
||||
sg = &urb->sg[i];
|
||||
if (!sg)
|
||||
continue;
|
||||
|
||||
skb_free_frag(sg_virt(sg));
|
||||
}
|
||||
usb_free_urb(buf->urb);
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(mt76u_buf_free);
|
||||
|
@ -478,7 +484,8 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
|
|||
nsgs = 1;
|
||||
}
|
||||
|
||||
for (i = 0; i < MT_NUM_RX_ENTRIES; i++) {
|
||||
q->ndesc = MT_NUM_RX_ENTRIES;
|
||||
for (i = 0; i < q->ndesc; i++) {
|
||||
err = mt76u_buf_alloc(dev, &q->entry[i].ubuf,
|
||||
nsgs, q->buf_size,
|
||||
SKB_WITH_OVERHEAD(q->buf_size),
|
||||
|
@ -486,7 +493,6 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
|
|||
if (err < 0)
|
||||
return err;
|
||||
}
|
||||
q->ndesc = MT_NUM_RX_ENTRIES;
|
||||
|
||||
return mt76u_submit_rx_buffers(dev);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue