* [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler
2020-06-30 4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
@ 2020-06-30 4:37 ` sean.wang
2020-06-30 7:13 ` Lorenzo Bianconi
2020-06-30 4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
` (2 subsequent siblings)
3 siblings, 1 reply; 8+ messages in thread
From: sean.wang @ 2020-06-30 4:37 UTC (permalink / raw)
To: nbd, lorenzo.bianconi
Cc: linux-mediatek, sean.wang, linux-wireless, ryder.lee
From: Sean Wang <sean.wang@mediatek.com>
Fix potential memory leak in mcu message handler on error condition.
Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
index cd709fd617db..3e66ff98cab8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
@@ -34,7 +34,6 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
ret = mt76u_bulk_msg(&dev->mt76, skb->data, skb->len, NULL,
1000, ep);
- dev_kfree_skb(skb);
if (ret < 0)
goto out;
@@ -43,6 +42,7 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
out:
mutex_unlock(&mdev->mcu.mutex);
+ dev_kfree_skb(skb);
return ret;
}
--
2.25.1
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler
2020-06-30 4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
@ 2020-06-30 7:13 ` Lorenzo Bianconi
0 siblings, 0 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30 7:13 UTC (permalink / raw)
To: sean.wang
Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd
[-- Attachment #1.1: Type: text/plain, Size: 1166 bytes --]
> From: Sean Wang <sean.wang@mediatek.com>
>
> Fix potential memory leak in mcu message handler on error condition.
>
> Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
> index cd709fd617db..3e66ff98cab8 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_mcu.c
> @@ -34,7 +34,6 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
>
> ret = mt76u_bulk_msg(&dev->mt76, skb->data, skb->len, NULL,
> 1000, ep);
> - dev_kfree_skb(skb);
> if (ret < 0)
> goto out;
>
> @@ -43,6 +42,7 @@ mt7663u_mcu_send_message(struct mt76_dev *mdev, struct sk_buff *skb,
>
> out:
> mutex_unlock(&mdev->mcu.mutex);
> + dev_kfree_skb(skb);
>
> return ret;
> }
> --
> 2.25.1
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
[-- Attachment #2: Type: text/plain, Size: 170 bytes --]
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH 3/3] mt76: mt7615: fix potential memory leak in mcu message handler
2020-06-30 4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
2020-06-30 4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
@ 2020-06-30 4:37 ` sean.wang
2020-06-30 7:17 ` Lorenzo Bianconi
2020-06-30 7:07 ` [PATCH 1/3] mt76: mt7663u: fix memory leak in set key Lorenzo Bianconi
2020-06-30 7:24 ` Lorenzo Bianconi
3 siblings, 1 reply; 8+ messages in thread
From: sean.wang @ 2020-06-30 4:37 UTC (permalink / raw)
To: nbd, lorenzo.bianconi
Cc: linux-mediatek, sean.wang, linux-wireless, ryder.lee
From: Sean Wang <sean.wang@mediatek.com>
Fix potential memory leak in mcu message handler on error condition.
Fixes: 0e6a29e477f3 ("mt76: mt7615: add support to read temperature from mcu")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index 1b46cccd93c5..58e3838a3dba 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -183,8 +183,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
int ret = 0;
- if (seq != rxd->seq)
- return -EAGAIN;
+ if (seq != rxd->seq) {
+ ret = -EAGAIN;
+ goto out;
+ }
switch (cmd) {
case MCU_CMD_PATCH_SEM_CONTROL:
@@ -215,6 +217,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
default:
break;
}
+out:
dev_kfree_skb(skb);
return ret;
--
2.25.1
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH 3/3] mt76: mt7615: fix potential memory leak in mcu message handler
2020-06-30 4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
@ 2020-06-30 7:17 ` Lorenzo Bianconi
0 siblings, 0 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30 7:17 UTC (permalink / raw)
To: sean.wang
Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd
[-- Attachment #1.1: Type: text/plain, Size: 1257 bytes --]
> From: Sean Wang <sean.wang@mediatek.com>
>
> Fix potential memory leak in mcu message handler on error condition.
>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
> Fixes: 0e6a29e477f3 ("mt76: mt7615: add support to read temperature from mcu")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
> drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
> index 1b46cccd93c5..58e3838a3dba 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
> @@ -183,8 +183,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
> struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data;
> int ret = 0;
>
> - if (seq != rxd->seq)
> - return -EAGAIN;
> + if (seq != rxd->seq) {
> + ret = -EAGAIN;
> + goto out;
> + }
>
> switch (cmd) {
> case MCU_CMD_PATCH_SEM_CONTROL:
> @@ -215,6 +217,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd,
> default:
> break;
> }
> +out:
> dev_kfree_skb(skb);
>
> return ret;
> --
> 2.25.1
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
[-- Attachment #2: Type: text/plain, Size: 170 bytes --]
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 1/3] mt76: mt7663u: fix memory leak in set key
2020-06-30 4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
2020-06-30 4:37 ` [PATCH 2/3] mt76: mt7663u: fix potential memory leak in mcu message handler sean.wang
2020-06-30 4:37 ` [PATCH 3/3] mt76: mt7615: " sean.wang
@ 2020-06-30 7:07 ` Lorenzo Bianconi
2020-06-30 7:24 ` Lorenzo Bianconi
3 siblings, 0 replies; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30 7:07 UTC (permalink / raw)
To: sean.wang
Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd
[-- Attachment #1.1: Type: text/plain, Size: 1784 bytes --]
> From: Sean Wang <sean.wang@mediatek.com>
>
> Fix memory leak in set key.
>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
> Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
> .../net/wireless/mediatek/mt76/mt7615/usb.c | 22 +++++++++++++------
> 1 file changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> index 0ba28d37c414..96a081be108e 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> @@ -165,12 +165,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
>
> lockdep_assert_held(&dev->mt76.mutex);
>
> - if (!sta)
> - return -EINVAL;
> + if (!sta) {
> + err = -EINVAL;
> + goto out;
> + }
>
> cipher = mt7615_mac_get_cipher(key->cipher);
> - if (cipher == MT_CIPHER_NONE)
> - return -EOPNOTSUPP;
> + if (cipher == MT_CIPHER_NONE) {
> + err = -EOPNOTSUPP;
> + goto out;
> + }
>
> wcid = &wd->sta->wcid;
>
> @@ -178,19 +182,23 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
> err = mt7615_mac_wtbl_update_key(dev, wcid, key->key, key->keylen,
> cipher, key->cmd);
> if (err < 0)
> - return err;
> + goto out;
>
> err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, key->keyidx,
> key->cmd);
> if (err < 0)
> - return err;
> + goto out;
>
> if (key->cmd == SET_KEY)
> wcid->cipher |= BIT(cipher);
> else
> wcid->cipher &= ~BIT(cipher);
>
> - return 0;
> +out:
> + kfree(key->key);
> + kfree(wd);
> +
> + return err;
> }
>
> void mt7663u_wtbl_work(struct work_struct *work)
> --
> 2.25.1
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
[-- Attachment #2: Type: text/plain, Size: 170 bytes --]
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH 1/3] mt76: mt7663u: fix memory leak in set key
2020-06-30 4:37 [PATCH 1/3] mt76: mt7663u: fix memory leak in set key sean.wang
` (2 preceding siblings ...)
2020-06-30 7:07 ` [PATCH 1/3] mt76: mt7663u: fix memory leak in set key Lorenzo Bianconi
@ 2020-06-30 7:24 ` Lorenzo Bianconi
2020-06-30 21:41 ` sean.wang
3 siblings, 1 reply; 8+ messages in thread
From: Lorenzo Bianconi @ 2020-06-30 7:24 UTC (permalink / raw)
To: sean.wang
Cc: linux-mediatek, lorenzo.bianconi, ryder.lee, linux-wireless, nbd
[-- Attachment #1.1: Type: text/plain, Size: 1811 bytes --]
> From: Sean Wang <sean.wang@mediatek.com>
>
> Fix memory leak in set key.
>
> Fixes: eb99cc95c3b6 ("mt76: mt7615: introduce mt7663u support")
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
> .../net/wireless/mediatek/mt76/mt7615/usb.c | 22 +++++++++++++------
> 1 file changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> index 0ba28d37c414..96a081be108e 100644
> --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb.c
> @@ -165,12 +165,16 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
>
> lockdep_assert_held(&dev->mt76.mutex);
>
> - if (!sta)
> - return -EINVAL;
> + if (!sta) {
> + err = -EINVAL;
> + goto out;
> + }
>
> cipher = mt7615_mac_get_cipher(key->cipher);
> - if (cipher == MT_CIPHER_NONE)
> - return -EOPNOTSUPP;
> + if (cipher == MT_CIPHER_NONE) {
> + err = -EOPNOTSUPP;
> + goto out;
> + }
>
> wcid = &wd->sta->wcid;
>
> @@ -178,19 +182,23 @@ __mt7663u_mac_set_key(struct mt7615_dev *dev,
> err = mt7615_mac_wtbl_update_key(dev, wcid, key->key, key->keylen,
> cipher, key->cmd);
> if (err < 0)
> - return err;
> + goto out;
>
> err = mt7615_mac_wtbl_update_pk(dev, wcid, cipher, key->keyidx,
> key->cmd);
> if (err < 0)
> - return err;
> + goto out;
>
> if (key->cmd == SET_KEY)
> wcid->cipher |= BIT(cipher);
> else
> wcid->cipher &= ~BIT(cipher);
>
> - return 0;
> +out:
> + kfree(key->key);
> + kfree(wd);
Actually we do not need to free wd since it is done in mt7663u_wtbl_work()
> +
> + return err;
> }
>
> void mt7663u_wtbl_work(struct work_struct *work)
> --
> 2.25.1
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
[-- Attachment #2: Type: text/plain, Size: 170 bytes --]
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 8+ messages in thread