From patchwork Tue Oct 27 13:48:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 289613 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64A9CC8301C for ; Tue, 27 Oct 2020 15:47:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 12105207C3 for ; Tue, 27 Oct 2020 15:47:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603813652; bh=rP/DFx3gXFgP9X/O8dpP/nA/rlDey5Oox/d9evkzBtk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=L/KeyRXGvsr1NjweWYv8Sc3RkD0yEpOyXDDjs64KKlzzRAVTN3ynEzER+vXO+SFIH oByewETX9UbA9JgChiBNz6+lO2eEAj8/P15ErItWdfyPlYc7A/ZdRYnXEbCkE0vYpa hhQmpZdGn9peX4czWQugFkABwA9Svt/h5Bkig5EE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1802194AbgJ0Pp7 (ORCPT ); Tue, 27 Oct 2020 11:45:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:44934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1798563AbgJ0P24 (ORCPT ); Tue, 27 Oct 2020 11:28:56 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5373E22275; Tue, 27 Oct 2020 15:28:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603812524; bh=rP/DFx3gXFgP9X/O8dpP/nA/rlDey5Oox/d9evkzBtk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OmA1IhqOXvcdRLWEVjy8SNMHyTAz0oD01wHRzbTgCdT5OxoYOqxRqcT4zhy0r/JVA BQEo5EzyaF6a7Gh5LNgONeK1PdBvx3VTmN6SE644udz3iUfU4XDiwP/7Ok4tZez1Su 0lM9Ns2n9ojbVlfsD7G0vzHF3ulYWI2i2Ntu5ZD0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Kalle Valo , Sasha Levin Subject: [PATCH 5.9 238/757] ath11k: fix a double free and a memory leak Date: Tue, 27 Oct 2020 14:48:08 +0100 Message-Id: <20201027135501.754308291@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135450.497324313@linuxfoundation.org> References: <20201027135450.497324313@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tom Rix [ Upstream commit 7e8453e35e406981d7c529ff8f804285bc894ba3 ] clang static analyzer reports this problem mac.c:6204:2: warning: Attempt to free released memory kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The channels pointer is allocated in ath11k_mac_setup_channels_rates() When it fails midway, it cleans up the memory it has already allocated. So the error handling needs to skip freeing the memory. There is a second problem. ath11k_mac_setup_channels_rates(), allocates 3 channels. err_free misses releasing ar->mac.sbands[NL80211_BAND_6GHZ].channels Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Tom Rix Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200906212625.17059-1-trix@redhat.com Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath11k/mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 94ae2b9ea6635..4674f0aca8e9b 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -6006,7 +6006,7 @@ static int __ath11k_mac_register(struct ath11k *ar) ret = ath11k_mac_setup_channels_rates(ar, cap->supported_bands); if (ret) - goto err_free; + goto err; ath11k_mac_setup_ht_vht_cap(ar, cap, &ht_cap); ath11k_mac_setup_he_cap(ar, cap); @@ -6120,7 +6120,9 @@ static int __ath11k_mac_register(struct ath11k *ar) err_free: kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels); + kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels); +err: SET_IEEE80211_DEV(ar->hw, NULL); return ret; }