Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1656408 > unrolled thread
| Started by | "Peter S. Housel" <housel@acm.org> |
|---|---|
| First post | 2017-06-02 19:40 +0200 |
| Last post | 2017-06-03 17:50 +0200 |
| Articles | 6 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain "Peter S. Housel" <housel@acm.org> - 2017-06-02 19:40 +0200
Re: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Florian Fainelli <f.fainelli@gmail.com> - 2017-06-02 20:50 +0200
Re: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Franky Lin <franky.lin@broadcom.com> - 2017-06-02 21:00 +0200
[PATCH v2] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain "Peter S. Housel" <housel@acm.org> - 2017-06-03 00:40 +0200
Re: [PATCH v2] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-06-03 17:40 +0200
Re: [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-06-03 17:50 +0200
| From | "Peter S. Housel" <housel@acm.org> |
|---|---|
| Date | 2017-06-02 19:40 +0200 |
| Subject | [PATCH] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain |
| Message-ID | <tNYIh-4cS-5@gated-at.bofh.it> |
An earlier change to this function (3bdae810721b) fixed a leak in the
case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the
glob_skb buffer, used for emulating a scattering read, is never used
or referenced after its contents are copied into the destination
buffers, and therefore always needs to be freed by the end of the
function.
Signed-off-by: Peter S. Housel <housel@acm.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index 9b970dc..4c5064f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -727,15 +727,16 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
return -ENOMEM;
err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
glom_skb);
- if (err) {
- brcmu_pkt_buf_free_skb(glom_skb);
- goto done;
- }
+ if (err)
+ goto free_glom_skb;
skb_queue_walk(pktq, skb) {
memcpy(skb->data, glom_skb->data, skb->len);
skb_pull(glom_skb, skb->len);
}
+
+free_glom_skb:
+ brcmu_pkt_buf_free_skb(glom_skb);
} else
err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
pktq);
--
2.7.4
[toc] | [next] | [standalone]
| From | Florian Fainelli <f.fainelli@gmail.com> |
|---|---|
| Date | 2017-06-02 20:50 +0200 |
| Message-ID | <tNZO1-4PY-9@gated-at.bofh.it> |
| In reply to | #1656408 |
On 06/02/2017 10:22 AM, Peter S. Housel wrote:
> An earlier change to this function (3bdae810721b) fixed a leak in the
> case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the
> glob_skb buffer, used for emulating a scattering read, is never used
> or referenced after its contents are copied into the destination
> buffers, and therefore always needs to be freed by the end of the
> function.
That looks correct, could you add the relevant Fixes tag for this?
Fixes: 3bdae810721b ("brcmfmac: Fix glob_skb leak in
brcmf_sdiod_recv_chain")
Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host
without sg support")
BTW, you made the same typo that I did, it's actually glom_skb ;)
>
> Signed-off-by: Peter S. Housel <housel@acm.org>
> ---
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
> index 9b970dc..4c5064f 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
> @@ -727,15 +727,16 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
> return -ENOMEM;
> err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
> glom_skb);
> - if (err) {
> - brcmu_pkt_buf_free_skb(glom_skb);
> - goto done;
> - }
> + if (err)
> + goto free_glom_skb;
>
> skb_queue_walk(pktq, skb) {
> memcpy(skb->data, glom_skb->data, skb->len);
> skb_pull(glom_skb, skb->len);
> }
> +
> +free_glom_skb:
> + brcmu_pkt_buf_free_skb(glom_skb);
> } else
> err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
> pktq);
>
--
Florian
[toc] | [prev] | [next] | [standalone]
| From | Franky Lin <franky.lin@broadcom.com> |
|---|---|
| Date | 2017-06-02 21:00 +0200 |
| Message-ID | <tNZXH-4Tg-1@gated-at.bofh.it> |
| In reply to | #1656408 |
On Fri, Jun 2, 2017 at 10:22 AM, Peter S. Housel <housel@acm.org> wrote:
> An earlier change to this function (3bdae810721b) fixed a leak in the
> case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the
> glob_skb buffer, used for emulating a scattering read, is never used
> or referenced after its contents are copied into the destination
> buffers, and therefore always needs to be freed by the end of the
> function.
>
> Signed-off-by: Peter S. Housel <housel@acm.org>
> ---
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
> index 9b970dc..4c5064f 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
> @@ -727,15 +727,16 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
> return -ENOMEM;
> err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
> glom_skb);
> - if (err) {
> - brcmu_pkt_buf_free_skb(glom_skb);
> - goto done;
> - }
> + if (err)
> + goto free_glom_skb;
>
> skb_queue_walk(pktq, skb) {
> memcpy(skb->data, glom_skb->data, skb->len);
> skb_pull(glom_skb, skb->len);
> }
> +
> +free_glom_skb:
> + brcmu_pkt_buf_free_skb(glom_skb);
What about
if (!err) {
skb_queue_walk(pktq, skb) {
memcpy(skb->data, glom_skb->data, skb->len);
skb_pull(glom_skb, skb->len);
}
}
brcmu_pkt_buf_free_skb(glom_skb);
Then no goto is needed.
Thanks,
Franky
> } else
> err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
> pktq);
> --
> 2.7.4
>
[toc] | [prev] | [next] | [standalone]
| From | "Peter S. Housel" <housel@acm.org> |
|---|---|
| Date | 2017-06-03 00:40 +0200 |
| Subject | [PATCH v2] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain |
| Message-ID | <tO3oB-78v-3@gated-at.bofh.it> |
| In reply to | #1656470 |
An earlier change to this function (3bdae810721b) fixed a leak in the
case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the
glom_skb buffer, used for emulating a scattering read, is never used
or referenced after its contents are copied into the destination
buffers, and therefore always needs to be freed by the end of the
function.
Fixes: 3bdae810721b ("brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain")
Fixes: a413e39a38573 ("brcmfmac: fix brcmf_sdcard_recv_chain() for host without sg support")
Signed-off-by: Peter S. Housel <housel@acm.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 14 ++++++--------
1 file changed, 6 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
index 9b970dc..30fb54e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
@@ -727,15 +727,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
return -ENOMEM;
err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
glom_skb);
- if (err) {
- brcmu_pkt_buf_free_skb(glom_skb);
- goto done;
- }
-
- skb_queue_walk(pktq, skb) {
- memcpy(skb->data, glom_skb->data, skb->len);
- skb_pull(glom_skb, skb->len);
+ if (!err) {
+ skb_queue_walk(pktq, skb) {
+ memcpy(skb->data, glom_skb->data, skb->len);
+ skb_pull(glom_skb, skb->len);
+ }
}
+ brcmu_pkt_buf_free_skb(glom_skb);
} else
err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
pktq);
--
2.7.4
[toc] | [prev] | [next] | [standalone]
| From | Andy Shevchenko <andy.shevchenko@gmail.com> |
|---|---|
| Date | 2017-06-03 17:40 +0200 |
| Subject | Re: [PATCH v2] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain |
| Message-ID | <tOjjH-jM-1@gated-at.bofh.it> |
| In reply to | #1656610 |
On Sat, Jun 3, 2017 at 1:29 AM, Peter S. Housel <housel@acm.org> wrote:
> An earlier change to this function (3bdae810721b) fixed a leak in the
> case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the
> glom_skb buffer, used for emulating a scattering read, is never used
> or referenced after its contents are copied into the destination
> buffers, and therefore always needs to be freed by the end of the
> function.
> err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
> glom_skb);
> - if (err) {
> - brcmu_pkt_buf_free_skb(glom_skb);
> - goto done;
> - }
> -
> - skb_queue_walk(pktq, skb) {
> - memcpy(skb->data, glom_skb->data, skb->len);
> - skb_pull(glom_skb, skb->len);
> + if (!err) {
This is not so often in use type of pattern.
> + skb_queue_walk(pktq, skb) {
> + memcpy(skb->data, glom_skb->data, skb->len);
> + skb_pull(glom_skb, skb->len);
> + }
> }
> + brcmu_pkt_buf_free_skb(glom_skb);
Can we just add this one line instead or I'm missing something?
> } else
> err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
> pktq);
--
With Best Regards,
Andy Shevchenko
[toc] | [prev] | [next] | [standalone]
| From | Andy Shevchenko <andy.shevchenko@gmail.com> |
|---|---|
| Date | 2017-06-03 17:50 +0200 |
| Message-ID | <tOjtn-mU-3@gated-at.bofh.it> |
| In reply to | #1656470 |
On Fri, Jun 2, 2017 at 9:52 PM, Franky Lin <franky.lin@broadcom.com> wrote:
> On Fri, Jun 2, 2017 at 10:22 AM, Peter S. Housel <housel@acm.org> wrote:
>> err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
>> glom_skb);
>> - if (err) {
>> - brcmu_pkt_buf_free_skb(glom_skb);
>> - goto done;
>> - }
> What about
> if (!err) {
> skb_queue_walk(pktq, skb) {
> memcpy(skb->data, glom_skb->data, skb->len);
> skb_pull(glom_skb, skb->len);
> }
> }
> brcmu_pkt_buf_free_skb(glom_skb);
>
> Then no goto is needed.
For my point of view it has two subtle inconveniences:
1. Not so usual pattern in use if (!ret)
2. Less error prone in case someone decides to expand the code and
missed ! or something else there.
Since both makes an approach less error prone I wouldn't suggest doing
that as I commented in new version.
--
With Best Regards,
Andy Shevchenko
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web