From cb83585e1121bd6d6c039cf09fa32380bf8b6258 Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Sun, 10 Feb 2019 22:49:14 +0100 Subject: [PATCH] mt76: usb: fix possible memory leak in mt76u_buf_free Move q->ndesc initialization before the for loop in mt76u_alloc_rx since otherwise allocated urbs will not be freed in mt76u_buf_free Double-check scatterlist pointer in mt76u_buf_free Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau --- drivers/net/wireless/mediatek/mt76/usb.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c index 018a8cf0941e..aee5ff124055 100644 --- a/drivers/net/wireless/mediatek/mt76/usb.c +++ b/drivers/net/wireless/mediatek/mt76/usb.c @@ -330,10 +330,16 @@ int mt76u_buf_alloc(struct mt76_dev *dev, struct mt76u_buf *buf, void mt76u_buf_free(struct mt76u_buf *buf) { struct urb *urb = buf->urb; + struct scatterlist *sg; int i; - for (i = 0; i < urb->num_sgs; i++) - skb_free_frag(sg_virt(&urb->sg[i])); + for (i = 0; i < urb->num_sgs; i++) { + sg = &urb->sg[i]; + if (!sg) + continue; + + skb_free_frag(sg_virt(sg)); + } usb_free_urb(buf->urb); } EXPORT_SYMBOL_GPL(mt76u_buf_free); @@ -537,7 +543,8 @@ static int mt76u_alloc_rx(struct mt76_dev *dev) nsgs = 1; } - for (i = 0; i < MT_NUM_RX_ENTRIES; i++) { + q->ndesc = MT_NUM_RX_ENTRIES; + for (i = 0; i < q->ndesc; i++) { err = mt76u_buf_alloc(dev, &q->entry[i].ubuf, nsgs, q->buf_size, SKB_WITH_OVERHEAD(q->buf_size), @@ -545,7 +552,6 @@ static int mt76u_alloc_rx(struct mt76_dev *dev) if (err < 0) return err; } - q->ndesc = MT_NUM_RX_ENTRIES; return mt76u_submit_rx_buffers(dev); }