Linux-mediatek Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 1/3] mt76: mt7663u: fix memory leak in set key
@ 2020-06-30  4:37 sean.wang
  2020-06-30  4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
                   ` (3 more replies)
  0 siblings, 4 replies; 8+ messages in thread
From: sean.wang @ 2020-06-30  4:37 UTC (permalink / raw)
  To: nbd, lorenzo.bianconi
  Cc: linux-mediatek, sean.wang, linux-wireless, ryder.lee

From: Sean Wang <sean.wang@mediatek.com>

Fix memory leak in set key.

Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
 .../net/wireless/mediatek/mt76/mt7615/usb.c   | 22 +++++++++++++------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
index 0ba28d37c414..96a081be108e 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
@@ -165,12 +165,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
 
 	lockdep_assert_held(&dev->mt76.mutex);
 
-	if (!sta)
-		return -EINVAL;
+	if (!sta) {
+		err = -EINVAL;
+		goto out;
+	}
 
 	cipher = mt7615_mac_get_cipher(key->cipher);
-	if (cipher == MT_CIPHER_NONE)
-		return -EOPNOTSUPP;
+	if (cipher == MT_CIPHER_NONE) {
+		err = -EOPNOTSUPP;
+		goto out;
+	}
 
 	wcid = &wd->sta->wcid;
 
@@ -178,19 +182,23 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
 	err = mt7615_mac_wtbl_update_key(dev, wcid, key->key, key->keylen,
 					 cipher, key->cmd);
 	if (err < 0)
-		return err;
+		goto out;
 
 	err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, key->keyidx,
 					key->cmd);
 	if (err < 0)
-		return err;
+		goto out;
 
 	if (key->cmd == SET_KEY)
 		wcid->cipher |= BIT(cipher);
 	else
 		wcid->cipher &= ~BIT(cipher);
 
-	return 0;
+out:
+	kfree(key->key);
+	kfree(wd);
+
+	return err;
 }
 
 void mt7663u_wtbl_work(struct work_struct *work)
-- 
2.25.1
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler
  2020-06-30  4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
@ 2020-06-30  4:37 ` sean.wang
  2020-06-30  7:13   ` Lorenzo Bianconi
  2020-06-30  4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
                   ` (2 subsequent siblings)
  3 siblings, 1 reply; 8+ messages in thread
From: sean.wang @ 2020-06-30  4:37 UTC (permalink / raw)
  To: nbd, lorenzo.bianconi
  Cc: linux-mediatek, sean.wang, linux-wireless, ryder.lee

From: Sean Wang <sean.wang@mediatek.com>

Fix potential memory leak in mcu message handler on error condition.

Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
index cd709fd617db..3e66ff98cab8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
@@ -34,7 +34,6 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 
 	ret = mt76u_bulk_msg(&dev->mt76, skb->data, skb->len, NULL,
 			     1000, ep);
-	dev_kfree_skb(skb);
 	if (ret < 0)
 		goto out;
 
@@ -43,6 +42,7 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
 
 out:
 	mutex_unlock(&mdev->mcu.mutex);
+	dev_kfree_skb(skb);
 
 	return ret;
 }
-- 
2.25.1
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* [PATCH 3/3] mt76: mt7615: fix potential memory leak in mcu message handler
  2020-06-30  4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
  2020-06-30  4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
@ 2020-06-30  4:37 ` sean.wang
  2020-06-30  7:17   ` Lorenzo Bianconi
  2020-06-30  7:07 ` [PATCH 1/3] mt76: mt7663u: fix memory leak in set key Lorenzo Bianconi
  2020-06-30  7:24 ` Lorenzo Bianconi
  3 siblings, 1 reply; 8+ messages in thread
From: sean.wang @ 2020-06-30  4:37 UTC (permalink / raw)
  To: nbd, lorenzo.bianconi
  Cc: linux-mediatek, sean.wang, linux-wireless, ryder.lee

From: Sean Wang <sean.wang@mediatek.com>

Fix potential memory leak in mcu message handler on error condition.

Fixes: 0e6a29e477f3 ("mt76: mt7615: add support to read temperature from mcu")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index 1b46cccd93c5..58e3838a3dba 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -183,8 +183,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
 	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
 	int ret = 0;
 
-	if (seq != rxd->seq)
-		return -EAGAIN;
+	if (seq != rxd->seq) {
+		ret = -EAGAIN;
+		goto out;
+	}
 
 	switch (cmd) {
 	case MCU_CMD_PATCH_SEM_CONTROL:
@@ -215,6 +217,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
 	default:
 		break;
 	}
+out:
 	dev_kfree_skb(skb);
 
 	return ret;
-- 
2.25.1
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH 1/3] mt76: mt7663u: fix memory leak in set key
  2020-06-30  4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
  2020-06-30  4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
  2020-06-30  4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
@ 2020-06-30  7:07 ` Lorenzo Bianconi
  2020-06-30  7:24 ` Lorenzo Bianconi
  3 siblings, 0 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30  7:07 UTC (permalink / raw)
  To: sean.wang
  Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd

[-- Attachment #1.1: Type: text/plain, Size: 1784 bytes --]

> From: Sean Wang <sean.wang@mediatek.com>
> 
> Fix memory leak in set key.
> 

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
>  .../net/wireless/mediatek/mt76/mt7615/usb.c   | 22 +++++++++++++------
>  1 file changed, 15 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> index 0ba28d37c414..96a081be108e 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> @@ -165,12 +165,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
>  
>  	lockdep_assert_held(&dev->mt76.mutex);
>  
> -	if (!sta)
> -		return -EINVAL;
> +	if (!sta) {
> +		err = -EINVAL;
> +		goto out;
> +	}
>  
>  	cipher = mt7615_mac_get_cipher(key->cipher);
> -	if (cipher == MT_CIPHER_NONE)
> -		return -EOPNOTSUPP;
> +	if (cipher == MT_CIPHER_NONE) {
> +		err = -EOPNOTSUPP;
> +		goto out;
> +	}
>  
>  	wcid = &wd->sta->wcid;
>  
> @@ -178,19 +182,23 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
>  	err = mt7615_mac_wtbl_update_key(dev, wcid, key->key, key->keylen,
>  					 cipher, key->cmd);
>  	if (err < 0)
> -		return err;
> +		goto out;
>  
>  	err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, key->keyidx,
>  					key->cmd);
>  	if (err < 0)
> -		return err;
> +		goto out;
>  
>  	if (key->cmd == SET_KEY)
>  		wcid->cipher |= BIT(cipher);
>  	else
>  		wcid->cipher &= ~BIT(cipher);
>  
> -	return 0;
> +out:
> +	kfree(key->key);
> +	kfree(wd);
> +
> +	return err;
>  }
>  
>  void mt7663u_wtbl_work(struct work_struct *work)
> -- 
> 2.25.1

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler
  2020-06-30  4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
@ 2020-06-30  7:13   ` Lorenzo Bianconi
  0 siblings, 0 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30  7:13 UTC (permalink / raw)
  To: sean.wang
  Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd

[-- Attachment #1.1: Type: text/plain, Size: 1166 bytes --]

> From: Sean Wang <sean.wang@mediatek.com>
> 
> Fix potential memory leak in mcu message handler on error condition.
> 
> Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
>  drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
> index cd709fd617db..3e66ff98cab8 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
> @@ -34,7 +34,6 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
>  
>  	ret = mt76u_bulk_msg(&dev->mt76, skb->data, skb->len, NULL,
>  			     1000, ep);
> -	dev_kfree_skb(skb);
>  	if (ret < 0)
>  		goto out;
>  
> @@ -43,6 +42,7 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
>  
>  out:
>  	mutex_unlock(&mdev->mcu.mutex);
> +	dev_kfree_skb(skb);
>  
>  	return ret;
>  }
> -- 
> 2.25.1

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH 3/3] mt76: mt7615: fix potential memory leak in mcu message handler
  2020-06-30  4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
@ 2020-06-30  7:17   ` Lorenzo Bianconi
  0 siblings, 0 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30  7:17 UTC (permalink / raw)
  To: sean.wang
  Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd

[-- Attachment #1.1: Type: text/plain, Size: 1257 bytes --]

> From: Sean Wang <sean.wang@mediatek.com>
> 
> Fix potential memory leak in mcu message handler on error condition.
> 

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> Fixes: 0e6a29e477f3 ("mt76: mt7615: add support to read temperature from mcu")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
>  drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
> index 1b46cccd93c5..58e3838a3dba 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
> @@ -183,8 +183,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
>  	struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
>  	int ret = 0;
>  
> -	if (seq != rxd->seq)
> -		return -EAGAIN;
> +	if (seq != rxd->seq) {
> +		ret = -EAGAIN;
> +		goto out;
> +	}
>  
>  	switch (cmd) {
>  	case MCU_CMD_PATCH_SEM_CONTROL:
> @@ -215,6 +217,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
>  	default:
>  		break;
>  	}
> +out:
>  	dev_kfree_skb(skb);
>  
>  	return ret;
> -- 
> 2.25.1

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH 1/3] mt76: mt7663u: fix memory leak in set key
  2020-06-30  4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
                   ` (2 preceding siblings ...)
  2020-06-30  7:07 ` [PATCH 1/3] mt76: mt7663u: fix memory leak in set key Lorenzo Bianconi
@ 2020-06-30  7:24 ` Lorenzo Bianconi
  2020-06-30 21:41   ` sean.wang
  3 siblings, 1 reply; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30  7:24 UTC (permalink / raw)
  To: sean.wang
  Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd

[-- Attachment #1.1: Type: text/plain, Size: 1811 bytes --]

> From: Sean Wang <sean.wang@mediatek.com>
> 
> Fix memory leak in set key.
> 
> Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
>  .../net/wireless/mediatek/mt76/mt7615/usb.c   | 22 +++++++++++++------
>  1 file changed, 15 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> index 0ba28d37c414..96a081be108e 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> @@ -165,12 +165,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
>  
>  	lockdep_assert_held(&dev->mt76.mutex);
>  
> -	if (!sta)
> -		return -EINVAL;
> +	if (!sta) {
> +		err = -EINVAL;
> +		goto out;
> +	}
>  
>  	cipher = mt7615_mac_get_cipher(key->cipher);
> -	if (cipher == MT_CIPHER_NONE)
> -		return -EOPNOTSUPP;
> +	if (cipher == MT_CIPHER_NONE) {
> +		err = -EOPNOTSUPP;
> +		goto out;
> +	}
>  
>  	wcid = &wd->sta->wcid;
>  
> @@ -178,19 +182,23 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
>  	err = mt7615_mac_wtbl_update_key(dev, wcid, key->key, key->keylen,
>  					 cipher, key->cmd);
>  	if (err < 0)
> -		return err;
> +		goto out;
>  
>  	err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, key->keyidx,
>  					key->cmd);
>  	if (err < 0)
> -		return err;
> +		goto out;
>  
>  	if (key->cmd == SET_KEY)
>  		wcid->cipher |= BIT(cipher);
>  	else
>  		wcid->cipher &= ~BIT(cipher);
>  
> -	return 0;
> +out:
> +	kfree(key->key);
> +	kfree(wd);

Actually we do not need to free wd since it is done in mt7663u_wtbl_work()

> +
> +	return err;
>  }
>  
>  void mt7663u_wtbl_work(struct work_struct *work)
> -- 
> 2.25.1

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH 1/3] mt76: mt7663u: fix memory leak in set key
  2020-06-30  7:24 ` Lorenzo Bianconi
@ 2020-06-30 21:41   ` sean.wang
  0 siblings, 0 replies; 8+ messages in thread
From: sean.wang @ 2020-06-30 21:41 UTC (permalink / raw)
  To: lorenzo
  Cc: Ryder.Lee, Sean Wang, linux-wireless, linux-kernel,
	linux-mediatek, lorenzo.bianconi, nbd

From: Sean Wang <sean.wang@mediatek.com>

Thanks, I'll have the next version to remove the unneeded kfree.

>
>> +
>> +	return err;
>>  }
>>
>>  void mt7663u_wtbl_work(struct work_struct *work)
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, back to index

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-30  4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
2020-06-30  4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
2020-06-30  7:13   ` Lorenzo Bianconi
2020-06-30  4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
2020-06-30  7:17   ` Lorenzo Bianconi
2020-06-30  7:07 ` [PATCH 1/3] mt76: mt7663u: fix memory leak in set key Lorenzo Bianconi
2020-06-30  7:24 ` Lorenzo Bianconi
2020-06-30 21:41   ` sean.wang

Linux-mediatek Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-mediatek/0 linux-mediatek/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mediatek linux-mediatek/ https://lore.kernel.org/linux-mediatek \
		linux-mediatek@lists.infradead.org
	public-inbox-index linux-mediatek

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.infradead.lists.linux-mediatek


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git