projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| d431789d GKH |
1 | From 519ce2f933fa14acf69d5c8cabcc18711943d629 Mon Sep 17 00:00:00 2001 |
| 2 | From: Larry Finger <Larry.Finger@lwfinger.net> | |
| 3 | Date: Thu, 14 Sep 2017 13:17:44 -0500 | |
| 4 | Subject: rtlwifi: rtl8192ee: Fix memory leak when loading firmware | |
| 5 | ||
| 6 | From: Larry Finger <Larry.Finger@lwfinger.net> | |
| 7 | ||
| 8 | commit 519ce2f933fa14acf69d5c8cabcc18711943d629 upstream. | |
| 9 | ||
| 10 | In routine rtl92ee_set_fw_rsvdpagepkt(), the driver allocates an skb, but | |
| 11 | never calls rtl_cmd_send_packet(), which will free the buffer. All other | |
| 12 | rtlwifi drivers perform this operation correctly. | |
| 13 | ||
| 14 | This problem has been in the driver since it was included in the kernel. | |
| 15 | Fortunately, each firmware load only leaks 4 buffers, which likely | |
| 16 | explains why it has not previously been detected. | |
| 17 | ||
| 18 | Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> | |
| 19 | Signed-off-by: Kalle Valo <kvalo@codeaurora.org> | |
| 20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 21 | ||
| 22 | --- | |
| 23 | drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | 6 ++++-- | |
| 24 | 1 file changed, 4 insertions(+), 2 deletions(-) | |
| 25 | ||
| 26 | --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | |
| 27 | +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c | |
| 28 | @@ -664,7 +664,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i | |
| 29 | struct rtl_priv *rtlpriv = rtl_priv(hw); | |
| 30 | struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); | |
| 31 | struct sk_buff *skb = NULL; | |
| 32 | - | |
| 33 | + bool rtstatus; | |
| 34 | u32 totalpacketlen; | |
| 35 | u8 u1rsvdpageloc[5] = { 0 }; | |
| 36 | bool b_dlok = false; | |
| 37 | @@ -727,7 +727,9 @@ void rtl92ee_set_fw_rsvdpagepkt(struct i | |
| 38 | memcpy((u8 *)skb_put(skb, totalpacketlen), | |
| 39 | &reserved_page_packet, totalpacketlen); | |
| 40 | ||
| 41 | - b_dlok = true; | |
| 42 | + rtstatus = rtl_cmd_send_packet(hw, skb); | |
| 43 | + if (rtstatus) | |
| 44 | + b_dlok = true; | |
| 45 | ||
| 46 | if (b_dlok) { | |
| 47 | RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD , |