summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFlorian Fainelli <f.fainelli@gmail.com>2016-07-18 16:24:35 -0700
committerJiri Slaby <jslaby@suse.cz>2016-10-07 10:06:54 +0200
commita2fc96f78a6e8c585d768aab3b22d00dc096ce4d (patch)
tree30520326aef35732eaa8683eebb9d0b299567868
parent9ed365af7518fe62d50f24d70829bd437f443c33 (diff)
downloadlinux-stable-a2fc96f78a6e8c585d768aab3b22d00dc096ce4d.tar.gz
linux-stable-a2fc96f78a6e8c585d768aab3b22d00dc096ce4d.tar.bz2
linux-stable-a2fc96f78a6e8c585d768aab3b22d00dc096ce4d.zip
brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill
commit 5c5fa1f464ac954982df1d96b9f9a5103d21aedd upstream. In case dma_mapping_error() returns an error in dma_rxfill, we would be leaking a packet that we allocated with brcmu_pkt_buf_get_skb(). Reported-by: coverity (CID 1081819) Fixes: 67d0cf50bd32 ("brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Acked-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
-rw-r--r--drivers/net/wireless/brcm80211/brcmsmac/dma.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
index 4fb9635d3919..7660b523dcf1 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
DMA_FROM_DEVICE);
- if (dma_mapping_error(di->dmadev, pa))
+ if (dma_mapping_error(di->dmadev, pa)) {
+ brcmu_pkt_buf_free_skb(p);
return false;
+ }
/* save the free packet pointer */
di->rxp[rxout] = p;