[PATCH wireless] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

[PATCH wireless] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

[Zhang Changzhong]

The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb
in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.

Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 595ae3a..175272c 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -335,6 +335,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 			bphy_err(drvr, "%s: failed to expand headroom\n",
 				 brcmf_ifname(ifp));
 			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
+			dev_kfree_skb(skb);
 			goto done;
 		}
 	}
-- 
2.9.5

Re: [PATCH wireless] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

[Kalle Valo]

Zhang Changzhong <zhangchangzhong@huawei.com> writes:

> The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb
> in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.
>
> Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>

I assume you have not tested this on a real device? Then it would be
really important to add "Compile tested only" to the commit log so that
we know it's untested.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH wireless] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

[Zhang Changzhong]

On 2022/11/17 18:09, Kalle Valo wrote:
> Zhang Changzhong <zhangchangzhong@huawei.com> writes:
> 
>> The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb
>> in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.
>>
>> Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
>> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
> 
> I assume you have not tested this on a real device? Then it would be
> really important to add "Compile tested only" to the commit log so that
> we know it's untested.
> 

OK, I'll add "Compile tested only" to the next version and other untested
patches.

Thanks,
Changzhong

Re: [PATCH wireless] brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

[Kalle Valo]

Zhang Changzhong <zhangchangzhong@huawei.com> writes:

> On 2022/11/17 18:09, Kalle Valo wrote:
>> Zhang Changzhong <zhangchangzhong@huawei.com> writes:
>> 
>>> The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb
>>> in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it.
>>>
>>> Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()")
>>> Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
>> 
>> I assume you have not tested this on a real device? Then it would be
>> really important to add "Compile tested only" to the commit log so that
>> we know it's untested.
>> 
>
> OK, I'll add "Compile tested only" to the next version and other untested
> patches.

Thanks. I wish it would become common to use that "Compile tested only".

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches