diff options
| author | Colin Ian King <colin.king@canonical.com> | 2018-05-27 22:17:02 +0100 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2018-06-13 14:50:40 +0300 |
| commit | 260e629bbf441585860e21d5e10d2e88437f47c8 (patch) | |
| tree | 179e22bf6faf500235ba2fc8e60a566750d4904a /drivers/net/wireless/ath/ath10k/wmi.c | |
| parent | 12b67b0d6bcbe91d8b0682610f43d1cd8cdf280e (diff) | |
| download | linux-stable-260e629bbf441585860e21d5e10d2e88437f47c8.tar.gz linux-stable-260e629bbf441585860e21d5e10d2e88437f47c8.tar.bz2 linux-stable-260e629bbf441585860e21d5e10d2e88437f47c8.zip | |
ath10k: fix memory leak of tpc_stats
Currently tpc_stats is allocated and is leaked on the return
path if num_tx_chain is greater than WMI_TPC_TX_N_CHAIN. Avoid
this leak by performing the check on num_tx_chain before the
allocation of tpc_stats.
Detected by CoverityScan, CID#1469422 ("Resource Leak")
Fixes: 4b190675ad06 ("ath10k: fix kernel panic while reading tpc_stats")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/ath/ath10k/wmi.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/wmi.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c index f97ab795cf2e..2319f79b34f0 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.c +++ b/drivers/net/wireless/ath/ath10k/wmi.c @@ -4602,10 +4602,6 @@ void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb) ev = (struct wmi_pdev_tpc_config_event *)skb->data; - tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC); - if (!tpc_stats) - return; - num_tx_chain = __le32_to_cpu(ev->num_tx_chain); if (num_tx_chain > WMI_TPC_TX_N_CHAIN) { @@ -4614,6 +4610,10 @@ void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb) return; } + tpc_stats = kzalloc(sizeof(*tpc_stats), GFP_ATOMIC); + if (!tpc_stats) + return; + ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table, num_tx_chain); |