Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1343566 > unrolled thread
| Started by | Colin King <colin.king@canonical.com> |
|---|---|
| First post | 2016-02-26 00:20 +0100 |
| Last post | 2016-02-26 00:20 +0100 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH][V2] mt7601u: do not free dma_buf when ivp allocation fails Colin King <colin.king@canonical.com> - 2016-02-26 00:20 +0100
Re: [PATCH][V2] mt7601u: do not free dma_buf when ivp allocation fails Julian Calaby <julian.calaby@gmail.com> - 2016-02-26 00:20 +0100
| From | Colin King <colin.king@canonical.com> |
|---|---|
| Date | 2016-02-26 00:20 +0100 |
| Subject | [PATCH][V2] mt7601u: do not free dma_buf when ivp allocation fails |
| Message-ID | <r6dmp-2FR-1@gated-at.bofh.it> |
From: Colin Ian King <colin.king@canonical.com>
If the allocation of ivp fails the error handling attempts to
free an uninitialized dma_buf; this data structure just contains
garbage on the stack, so the freeing will cause issues when the
urb, buf and dma fields are free'd. Fix this by not free'ing the
dma_buf if the ivp allocation fails.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/net/wireless/mediatek/mt7601u/mcu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c
index fbb1986..70e4b5e 100644
--- a/drivers/net/wireless/mediatek/mt7601u/mcu.c
+++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c
@@ -362,10 +362,10 @@ mt7601u_upload_firmware(struct mt7601u_dev *dev, const struct mt76_fw *fw)
int i, ret;
ivb = kmemdup(fw->ivb, sizeof(fw->ivb), GFP_KERNEL);
- if (!ivb || mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) {
- ret = -ENOMEM;
+ if (!ivb)
+ return -ENOMEM;
+ if (mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf))
goto error;
- }
ilm_len = le32_to_cpu(fw->hdr.ilm_len) - sizeof(fw->ivb);
dev_dbg(dev->dev, "loading FW - ILM %u + IVB %zu\n",
--
2.7.0
[toc] | [next] | [standalone]
| From | Julian Calaby <julian.calaby@gmail.com> |
|---|---|
| Date | 2016-02-26 00:20 +0100 |
| Message-ID | <r6dmp-2FR-3@gated-at.bofh.it> |
| In reply to | #1343566 |
Hi Colin,
On Fri, Feb 26, 2016 at 10:09 AM, Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> If the allocation of ivp fails the error handling attempts to
> free an uninitialized dma_buf; this data structure just contains
> garbage on the stack, so the freeing will cause issues when the
> urb, buf and dma fields are free'd. Fix this by not free'ing the
> dma_buf if the ivp allocation fails.
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> drivers/net/wireless/mediatek/mt7601u/mcu.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c
> index fbb1986..70e4b5e 100644
> --- a/drivers/net/wireless/mediatek/mt7601u/mcu.c
> +++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c
> @@ -362,10 +362,10 @@ mt7601u_upload_firmware(struct mt7601u_dev *dev, const struct mt76_fw *fw)
> int i, ret;
>
> ivb = kmemdup(fw->ivb, sizeof(fw->ivb), GFP_KERNEL);
> - if (!ivb || mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf)) {
> - ret = -ENOMEM;
> + if (!ivb)
> + return -ENOMEM;
> + if (mt7601u_usb_alloc_buf(dev, MCU_FW_URB_SIZE, &dma_buf))
> goto error;
Are you sure this is right? Isn't ret unset here and consequently
returned at the end of the error label?
Thanks,
--
Julian Calaby
Email: julian.calaby@gmail.com
Profile: http://www.google.com/profiles/julian.calaby/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web