From: Jesper Juhl <jj@chaosbits.net>
To: Greg Kroah-Hartman <gregkh@suse.de>
Cc: linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org,
"Justin P. Mattock" <justinmattock@gmail.com>,
Ilia Mirkin <imirkin@alum.mit.edu>,
Lucas De Marchi <lucas.demarchi@profusion.mobi>
Subject: [PATCH 2/2] Staging; Don't leak 'pstAddIndication' in CmHost.c::StoreCmControlResponseMessage()
Date: Tue, 24 Jan 2012 23:47:27 +0100 (CET) [thread overview]
Message-ID: <alpine.LNX.2.00.1201242346380.27508@swampdragon.chaosbits.net> (raw)
In-Reply-To: <alpine.LNX.2.00.1201242338500.27508@swampdragon.chaosbits.net>
We allocate memory for 'pstAddIndication' with kmalloc() in
drivers/staging/bcm/CmHost.c::StoreCmControlResponseMessage() and then
neglect to free it on a number of exit paths from that function.
This could probably be resolved cleaner/nicer, but this file needs a
serious overhaul in any case, so I opted for just fixing the problem
as directly as I could and then we can clean it up generally
later... This at least makes it stop bleeding..
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
drivers/staging/bcm/CmHost.c | 27 ++++++++++++++++++++-------
1 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/bcm/CmHost.c b/drivers/staging/bcm/CmHost.c
index 1fcc039..a404d30 100644
--- a/drivers/staging/bcm/CmHost.c
+++ b/drivers/staging/bcm/CmHost.c
@@ -1595,18 +1595,22 @@ ULONG StoreCmControlResponseMessage(PMINI_ADAPTER Adapter, PVOID pvBuffer, UINT
// For DSA_REQ, only up to "psfAuthorizedSet" parameter should be accessed by driver!
pstAddIndication = kmalloc(sizeof(*pstAddIndication), GFP_KERNEL);
- if (NULL == pstAddIndication)
+ if (!pstAddIndication)
return 0;
/* AUTHORIZED SET */
pstAddIndication->psfAuthorizedSet = (stServiceFlowParamSI *)
GetNextTargetBufferLocation(Adapter, pstAddIndicationAlt->u16TID);
- if (!pstAddIndication->psfAuthorizedSet)
+ if (!pstAddIndication->psfAuthorizedSet) {
+ kfree(pstAddIndication);
return 0;
+ }
if (StoreSFParam(Adapter, (PUCHAR)&pstAddIndicationAlt->sfAuthorizedSet,
- (ULONG)pstAddIndication->psfAuthorizedSet) != 1)
+ (ULONG)pstAddIndication->psfAuthorizedSet) != 1) {
+ kfree(pstAddIndication);
return 0;
+ }
/* This can't possibly be right */
pstAddIndication->psfAuthorizedSet = (stServiceFlowParamSI *)ntohl((ULONG)pstAddIndication->psfAuthorizedSet);
@@ -1622,6 +1626,7 @@ ULONG StoreCmControlResponseMessage(PMINI_ADAPTER Adapter, PVOID pvBuffer, UINT
AddRequest.psfParameterSet =pstAddIndication->psfAuthorizedSet ;
(*puBufferLength) = sizeof(stLocalSFAddRequest);
memcpy(pvBuffer, &AddRequest, sizeof(stLocalSFAddRequest));
+ kfree(pstAddIndication);
return 1;
}
@@ -1639,20 +1644,28 @@ ULONG StoreCmControlResponseMessage(PMINI_ADAPTER Adapter, PVOID pvBuffer, UINT
/* ADMITTED SET */
pstAddIndication->psfAdmittedSet = (stServiceFlowParamSI *)
GetNextTargetBufferLocation(Adapter, pstAddIndicationAlt->u16TID);
- if (!pstAddIndication->psfAdmittedSet)
+ if (!pstAddIndication->psfAdmittedSet) {
+ kfree(pstAddIndication);
return 0;
- if (StoreSFParam(Adapter, (PUCHAR)&pstAddIndicationAlt->sfAdmittedSet, (ULONG)pstAddIndication->psfAdmittedSet) != 1)
+ }
+ if (StoreSFParam(Adapter, (PUCHAR)&pstAddIndicationAlt->sfAdmittedSet, (ULONG)pstAddIndication->psfAdmittedSet) != 1) {
+ kfree(pstAddIndication);
return 0;
+ }
pstAddIndication->psfAdmittedSet = (stServiceFlowParamSI *)ntohl((ULONG)pstAddIndication->psfAdmittedSet);
/* ACTIVE SET */
pstAddIndication->psfActiveSet = (stServiceFlowParamSI *)
GetNextTargetBufferLocation(Adapter, pstAddIndicationAlt->u16TID);
- if (!pstAddIndication->psfActiveSet)
+ if (!pstAddIndication->psfActiveSet) {
+ kfree(pstAddIndication);
return 0;
- if (StoreSFParam(Adapter, (PUCHAR)&pstAddIndicationAlt->sfActiveSet, (ULONG)pstAddIndication->psfActiveSet) != 1)
+ }
+ if (StoreSFParam(Adapter, (PUCHAR)&pstAddIndicationAlt->sfActiveSet, (ULONG)pstAddIndication->psfActiveSet) != 1) {
+ kfree(pstAddIndication);
return 0;
+ }
pstAddIndication->psfActiveSet = (stServiceFlowParamSI *)ntohl((ULONG)pstAddIndication->psfActiveSet);
--
1.7.8.4
--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Don't top-post http://www.catb.org/jargon/html/T/top-post.html
Plain text mails only, please.
next prev parent reply other threads:[~2012-01-24 22:47 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-24 22:44 [PATCH 0/2] Staging: Style cleanup and mem leak fixes for drivers/staging/bcm/CmHost.c Jesper Juhl
2012-01-24 22:46 ` [PATCH 1/2] Staging; bcm/CmHost.c: Style cleanup Jesper Juhl
2012-01-24 23:13 ` Joe Perches
2012-01-24 23:17 ` Jesper Juhl
2012-01-25 6:26 ` Dan Carpenter
2012-01-27 23:43 ` Jesper Juhl
2012-01-28 7:24 ` Dan Carpenter
2012-01-24 22:47 ` Jesper Juhl [this message]
2012-02-09 17:52 ` [PATCH 2/2] Staging; Don't leak 'pstAddIndication' in CmHost.c::StoreCmControlResponseMessage() Greg KH
2012-02-09 22:33 ` Jesper Juhl
2012-02-10 18:00 ` Staging: bcm: " Greg KH
2012-02-11 23:54 ` Jesper Juhl
2012-02-14 4:05 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LNX.2.00.1201242346380.27508@swampdragon.chaosbits.net \
--to=jj@chaosbits.net \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@suse.de \
--cc=imirkin@alum.mit.edu \
--cc=justinmattock@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lucas.demarchi@profusion.mobi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).