package/kernel/mac80211/patches/380-0009-ath10k-fix-memory-leak-of-tpc_stats.patch

   1 From 260e629bbf441585860e21d5e10d2e88437f47c8 Mon Sep 17 00:00:00 2001
   2 From: Colin Ian King <colin.king@canonical.com>
   3 Date: Sun, 27 May 2018 22:17:02 +0100
   4 Subject: [PATCH] ath10k: fix memory leak of tpc_stats
   5
   6 Currently tpc_stats is allocated and is leaked on the return
   7 path if num_tx_chain is greater than WMI_TPC_TX_N_CHAIN. Avoid
   8 this leak by performing the check on num_tx_chain before the
   9 allocation of tpc_stats.
  10
  11 Detected by CoverityScan, CID#1469422 ("Resource Leak")
  12 Fixes: 4b190675ad06 ("ath10k: fix kernel panic while reading tpc_stats")
  13
  14 Signed-off-by: Colin Ian King <colin.king@canonical.com>
  15 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  16 ---
  17  drivers/net/wireless/ath/ath10k/wmi.c | 8 ++++----
  18  1 file changed, 4 insertions(+), 4 deletions(-)
  19
  20 --- a/drivers/net/wireless/ath/ath10k/wmi.c
  21 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
  22 @@ -4557,10 +4557,6 @@ void ath10k_wmi_event_pdev_tpc_config(st
  23
  24         ev = (struct wmi_pdev_tpc_config_event *)skb->data;
  25
  26 -       tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
  27 -       if (!tpc_stats)
  28 -               return;
  29 -
  30         num_tx_chain = __le32_to_cpu(ev->num_tx_chain);
  31
  32         if (num_tx_chain > WMI_TPC_TX_N_CHAIN) {
  33 @@ -4569,6 +4565,10 @@ void ath10k_wmi_event_pdev_tpc_config(st
  34                 return;
  35         }
  36
  37 +       tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC);
  38 +       if (!tpc_stats)
  39 +               return;
  40 +
  41         ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table,
  42                                             num_tx_chain);
  43