package/kernel/mac80211/patches/319-0022-brcmfmac-fix-memory-leak-in-brcmf_flowring_add_tdls_.patch

   1 From bc981641360183990de59da17f9f560f9150b801 Mon Sep 17 00:00:00 2001
   2 From: Arend Van Spriel <arend.vanspriel@broadcom.com>
   3 Date: Mon, 19 Sep 2016 12:09:53 +0100
   4 Subject: [PATCH] brcmfmac: fix memory leak in brcmf_flowring_add_tdls_peer()
   5
   6 In the error paths in brcmf_flowring_add_tdls_peer() the allocated
   7 resource should be freed.
   8
   9 Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
  10 Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
  11 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  12 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  13 ---
  14  drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c | 8 ++++++--
  15  1 file changed, 6 insertions(+), 2 deletions(-)
  16
  17 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
  18 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/flowring.c
  19 @@ -495,14 +495,18 @@ void brcmf_flowring_add_tdls_peer(struct
  20         } else {
  21                 search = flow->tdls_entry;
  22                 if (memcmp(search->mac, peer, ETH_ALEN) == 0)
  23 -                       return;
  24 +                       goto free_entry;
  25                 while (search->next) {
  26                         search = search->next;
  27                         if (memcmp(search->mac, peer, ETH_ALEN) == 0)
  28 -                               return;
  29 +                               goto free_entry;
  30                 }
  31                 search->next = tdls_entry;
  32         }
  33
  34         flow->tdls_active = true;
  35 +       return;
  36 +
  37 +free_entry:
  38 +       kfree(tdls_entry);
  39  }