: memory leak in rtw_free_cmd_obj if command is (_Set_Drv_Extra)

PATCH In review Wang, Xiaoming 3 participants 3 messages Mar 10, 2014 – Mar 17, 2014 Staging

Share & tools

Wang, Xiaoming

author

2014-03-10 01:29 UTC #0 lore raw

PATCH 1/1 : memory leak in rtw_free_cmd_obj if command is (_Set_Drv_Extra)

pcmd->parmbuf->pbuf has been allocated if command is GEN_CMD_CODE(_Set_Drv_Extra), and it enqueued by rtw_enqueue_cmd. rtw_cmd_thread dequeue pcmd by rtw_dequeue_cmd. The memory leak happened on this branch "if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) )" which goto post_process directly against freeing pcmd->parmbuf->pbuf in rtw_drvextra_cmd_hdl which is the cmd_hdl if command is (_Set_Drv_Extra). This patch free pcmd->parmbuf->pbuf on the forgotten branch to avoid memory leak.

Signed-off-by Zhang Dongxing <[email protected]>

Signed-off-by xiaoming wang <[email protected]>

drivers/staging/rtl8188eu/core/rtw_cmd.c +6 -1

index c0a0a52..1c7f505 100644
@@ -288,7 +288,7 @@ int rtw_cmd_thread(void *context)
        void (*pcmd_callback)(struct adapter *dev, struct cmd_obj *pcmd);
        struct adapter *padapter = (struct adapter *)context;
        struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
-
+       struct drvextra_cmd_parm *extra_parm = NULL;
 
        thread_enter("RTW_CMD_THREAD");

@@ -323,6 +323,11 @@ _next:
 
                if (_FAIL == rtw_cmd_filter(pcmdpriv, pcmd)) {
                        pcmd->res = H2C_DROPPED;
+                       if (pcmd->cmdcode == GEN_CMD_CODE(_Set_Drv_Extra)) {
+                               extra_parm = (struct drvextra_cmd_parm *)pcmd->parmbuf;
+                               if (extra_parm && extra_parm->pbuf && extra_parm->size > 0)
+                                       rtw_mfree(extra_parm->pbuf, extra_parm->size);
+                       }
                        goto post_process;
                }

Liu, Chuansheng

Reviewed-by on v1 1/1

2014-03-10 01:45 UTC #1 lore raw

Hi,

Quoted 51 lines

-----Original Message-----
From: Wang, Xiaoming
Sent: Monday, March 10, 2014 11:38 PM
To: [email protected]; [email protected]; [email protected]; [email protected]
Cc: [email protected]; [email protected]; Zhang, Dongxing; Wang, Xiaoming; Liu, Chuansheng
Subject: [PATCH] [staging][r8188eu]: memory leak in rtw_free_cmd_obj if command is (_Set_Drv_Extra)
pcmd->parmbuf->pbuf has been allocated if command is GEN_CMD_CODE(_Set_Drv_Extra),
and it enqueued by rtw_enqueue_cmd. rtw_cmd_thread dequeue pcmd by rtw_dequeue_cmd.
The memory leak happened on this branch "if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) )"
which goto post_process directly against freeing pcmd->parmbuf->pbuf in rtw_drvextra_cmd_hdl which is the cmd_hdl if command is (_Set_Drv_Extra). This patch free pcmd->parmbuf->pbuf on the forgotten branch to avoid memory leak.
Signed-off-by Zhang Dongxing <[email protected]>
Signed-off-by xiaoming wang <[email protected]>
drivers/staging/rtl8188eu/core/rtw_cmd.c +5 -1
index c0a0a52..1c7f505 100644
@@ -288,7 +288,7 @@ int rtw_cmd_thread(void *context)
        void (*pcmd_callback)(struct adapter *dev, struct cmd_obj *pcmd);
        struct adapter *padapter = (struct adapter *)context;
        struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
-
+       struct drvextra_cmd_parm *extra_parm = NULL;
 
        thread_enter("RTW_CMD_THREAD");
 
@@ -323,6 +323,11 @@ _next:
 
                if (_FAIL == rtw_cmd_filter(pcmdpriv, pcmd)) {
                        pcmd->res = H2C_DROPPED;
+                       if (pcmd->cmdcode ==
 GEN_CMD_CODE(_Set_Drv_Extra)) {
+                               extra_parm = (struct
 drvextra_cmd_parm *)pcmd->parmbuf;
+                               if (extra_parm && extra_parm->pbuf
 && extra_parm->size > 0)
+                                       rtw_mfree(extra_parm->pbuf,
extra_parm->size);
+ }

Quoted 3 lines

                        goto post_process;
                }

Reviewed-by Chuansheng Liu <[email protected]>

Thanks.

Best Regards
Chuansheng

��{.n�+��+%��ݶ��w��{.n�+��{��G��{ay�ʇڙ�,j��f��h��z_�(�階�ݢj"��m��G��?��&��~��iO��z��v�^�m��?�I�

Greg KH

maintainer

2014-03-17 21:36 UTC #2 lore raw

In reply to Wang, Xiaoming

Quoted 26 lines · Xiaoming

pcmd->parmbuf->pbuf has been allocated if command is GEN_CMD_CODE(_Set_Drv_Extra), and it enqueued by rtw_enqueue_cmd. rtw_cmd_thread dequeue pcmd by rtw_dequeue_cmd. The memory leak happened on this branch "if( _FAIL == rtw_cmd_filter(pcmdpriv, pcmd) )" which goto post_process directly against freeing pcmd->parmbuf->pbuf in rtw_drvextra_cmd_hdl which is the cmd_hdl if command is (_Set_Drv_Extra). This patch free pcmd->parmbuf->pbuf on the forgotten branch to avoid memory leak.
Signed-off-by Zhang Dongxing <[email protected]>
Signed-off-by xiaoming wang <[email protected]>
Reviewed-by Chuansheng Liu <[email protected]>
drivers/staging/rtl8188eu/core/rtw_cmd.c +1 -1
index c0a0a52..1c7f505 100644
@@ -288,7 +288,7 @@ int rtw_cmd_thread(void *context)
        void (*pcmd_callback)(struct adapter *dev, struct cmd_obj *pcmd);
        struct adapter *padapter = (struct adapter *)context;
        struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
-
+       struct drvextra_cmd_parm *extra_parm = NULL;
 
        thread_enter("RTW_CMD_THREAD");
 
@@ -323,6 +323,11 @@ _next:
 

drivers/staging/rtl8188eu/core/rtw_cmd.c _next: · line 333

Quoted 10 lines

drivers/staging/rtl8188eu/core/rtw_cmd.c +5 -0

                if (_FAIL == rtw_cmd_filter(pcmdpriv, pcmd)) {
                        pcmd->res = H2C_DROPPED;
+                       if (pcmd->cmdcode == GEN_CMD_CODE(_Set_Drv_Extra)) {
+                               extra_parm = (struct drvextra_cmd_parm *)pcmd->parmbuf;
+                               if (extra_parm && extra_parm->pbuf && extra_parm->size > 0)
+                                       rtw_mfree(extra_parm->pbuf, extra_parm->size);
+                       }
                        goto post_process;
                }

This patch has all the tabs converted to spaces and can not be applied :(

Please fix your email client and try again.

greg k-h