diff options
| author | Raveendran Somu <raveendran.somu@cypress.com> | 2020-03-25 03:20:25 -0500 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2020-03-26 11:43:53 +0200 |
| commit | 78179869dc3f5c0059bbf5d931a2717f1ad97ecd (patch) | |
| tree | d281e4e3f0819ac285eb4b718ad1311e648ba3ec /drivers/net/wireless | |
| parent | 93a5bfbc7cad8bf3dea81c9bc07761c1226a0860 (diff) | |
| download | lwn-78179869dc3f5c0059bbf5d931a2717f1ad97ecd.tar.gz lwn-78179869dc3f5c0059bbf5d931a2717f1ad97ecd.zip | |
brcmfmac: Fix double freeing in the fmac usb data path
When the brcmf_fws_process_skb() fails to get hanger slot for
queuing the skb, it tries to free the skb.
But the caller brcmf_netdev_start_xmit() of that funciton frees
the packet on error return value.
This causes the double freeing and which caused the kernel crash.
Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1585124429-97371-3-git-send-email-chi-hsien.lin@cypress.com
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c index 5e1a11c07551..10022c765354 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c @@ -2145,8 +2145,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb) brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_DELAYED, fifo, skb); brcmf_fws_schedule_deq(fws); } else { - bphy_err(drvr, "drop skb: no hanger slot\n"); - brcmf_txfinalize(ifp, skb, false); + bphy_err(drvr, "no hanger slot available\n"); rc = -ENOMEM; } brcmf_fws_unlock(fws); |