Patch "brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain" has been added to the 4.11-stable tree

This is a note to let you know that I've just added the patch titled

brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain

to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
brcmfmac-fix-glom_skb-leak-in-brcmf_sdiod_recv_chain.patch
and it can be found in the queue-4.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Peter S. Housel" <[email protected]>
Date: Mon, 12 Jun 2017 11:46:22 +0100
Subject: brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain

From: Peter S. Housel <[email protected]>

commit 5ea59db8a375216e6c915c5586f556766673b5a7 upstream.

An earlier change to this function (3bdae810721b) fixed a leak in the case of an unsuccessful call to brcmf_sdiod_buffrw(). However, the glom_skb buffer, used for emulating a scattering read, is never used or referenced after its contents are copied into the destination buffers, and therefore always needs to be freed by the end of the function.

---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

@@ -705,7 +705,7 @@ done:
 int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
 			   struct sk_buff_head *pktq, uint totlen)
 {
-	struct sk_buff *glom_skb;
+	struct sk_buff *glom_skb = NULL;
 	struct sk_buff *skb;
 	u32 addr = sdiodev->sbwad;
 	int err = 0;

@@ -726,10 +726,8 @@ int brcmf_sdiod_recv_chain(struct brcmf_
 			return -ENOMEM;
 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
 					 glom_skb);
-		if (err) {
-			brcmu_pkt_buf_free_skb(glom_skb);
+		if (err)
 			goto done;
-		}
 
 		skb_queue_walk(pktq, skb) {
 			memcpy(skb->data, glom_skb->data, skb->len);

@@ -740,6 +738,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
 					    pktq);
 
 done:
+	brcmu_pkt_buf_free_skb(glom_skb);
 	return err;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.11/brcmfmac-fix-glom_skb-leak-in-brcmf_sdiod_recv_chain.patch