From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f98.google.com (mail-oo1-f98.google.com [209.85.161.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0146837F32B for ; Mon, 3 Aug 2026 05:44:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.98 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785735854; cv=none; b=WkkbiSx/+hxJHpIAFY/VlufBGkeYFkfac+ZC0jJ80ZmyIEFESd6TNJFQxtt1uVvKAWIxKSELpkN2DIbBGjwSWZdaGiUVA9uTXiaKjpA9tgq/UhxOkCqaCj9ScbZo+eGfDkHUrR3tjszUvVKUXlQdrSsLcFOzc/aD4o2JALrCfFA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785735854; c=relaxed/simple; bh=yjB7RGHZWNCfModfSNNs6/sJuqTLBvL7I9fkLDpx6ag=; h=From:To:CC:Date:Message-ID:In-Reply-To:References:Subject: MIME-Version:Content-Type; b=rpih4c48rYfF3dXp3tYqyhukRtZLyoesO7EcgVa4iSmcBUu7OmiqVQCbJErVxg1HVW/Nb0ZvjFFkkApODboHarBC6sYs931zeCPaQ6rM5svaFTfkHkujkEeBPlUZ05b5gk4oqUC5Buh0K/mtMbWgkgVgC4EGbvYoOlav0b/+DXo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=PnWhTstw; arc=none smtp.client-ip=209.85.161.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="PnWhTstw" Received: by mail-oo1-f98.google.com with SMTP id 006d021491bc7-6ae6e407bfdso205618eaf.1 for ; Sun, 02 Aug 2026 22:44:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785735852; x=1786340652; h=content-transfer-encoding:content-type:mime-version:subject :user-agent:references:in-reply-to:message-id:date:cc:to:from :dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=df1R3651GFZlufP+Sp9/jqANKcFbF/GkeE2awbI5Hgs=; b=Z9tBjtDyoDhybHmIIpaz7yZr/kCmwecOT7D7ZKCGdqcjO4xFYuEPKNBe6RRSqbacTk zeRXrbT+GsHWPmgOrBCJPGtzCDrx+qO2sWeQHA883QQ9nmifcLCkcrY0B/JaLBBleQEx Oc2B8UkAwPM8YlfkKkHzdZP4J7OGySJoYI4oux2xDLooR3AwWDFOQfW3TsnS7nkbQiVU hg8haiHWjcDHVDj7uPyGbGfS7pruUMjMJEw+DdbGQt0RcwGWxTe8nlt1Q1gM3Nl7F0hm pT2rdTBv6c6yj/L79i/ZL4JxxcToLOVMQZFXbfPcipdORcrsXOCEMWFDyZPg6UuOzUsi ztRg== X-Forwarded-Encrypted: i=1; AHgh+Rrg+oQW/Kee1DjQkBWr5/KeIUtVYeLd00gXuS/RC3HszjK/Hn8vtDmpAIkrXMFxEBGgDSG8oTtsRYgJ4JE=@vger.kernel.org X-Gm-Message-State: AOJu0YyMw8msxqeXv5YA8+yCbQB2oXUraGbLL1E26FNTCyPHVZm8Hbf9 muCk0l53b7ylabPhbqTXAIE4cEGvXblZs0wHMjpgVuP3tudjshd1BnV8e39mIH32rnMW47frepc iGge3b6eu/SnoPJUttY4kqxW0/JKim7Vv6+RPwYLCkmFTnPBCv+GrUO2wL0oGclRWWOGRPxcL61 +NM6Iij6ycA9oMHbiPODfNeEudxrVzApkJWCB6WnQbDyw4MtoktNtjG7BG4o00NzEnYinRB0Cl3 u+U3HaLms0kQ+NCXBwGqYV/nA== X-Gm-Gg: AR+sD12n6nsBN9Uz2VOVELQypYVC8Zoi242EE3gNMx504Tx9F+7Q89UTFSsoZCvHjBX DwbDvwiVP6vAild8MnrzScieWALK0g/xiG49qsN6+AT8a21MS3+lmcPfyjnIfjuJ7zX8q3ukmBz nrl1Sy+WoBN3klKk1y4aZo+Td0dqZxA19Jjq5S62jJc0Y0flZzBhiKf4ASGiOLE3dlEPaWEWirQ a7Ptyvg6KS/wIJJic37V2FKAY9OHBQtnkvLC+ROthCDv5Z3sxGIhYiNJu4RYK/zGPzS9CJbnslv LLS74R6KGMrahiRlV/1KYMjBSKRbFuSOmoMcctpz3VSkOEH2KWe1Vy3eKpGZ7b660VsDzcV+PFg O5ZZvOz6lG5D46PgSKOflxM/DFEg/yClZfNyr5YMqWG1vyA/lUaPsFaYSXOTcziV4E8kocBe8KJ Z4W+FLfeCu0456qsqW+wu25xv/E+r7b4e1MvrZZbg= X-Received: by 2002:a05:6820:2005:b0:6ac:ae76:d3a7 with SMTP id 006d021491bc7-6ae431d59d4mr11798294eaf.10.1785735851725; Sun, 02 Aug 2026 22:44:11 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-27.dlp.protect.broadcom.com. [144.49.247.27]) by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6ae39f6ff65sm656870eaf.14.2026.08.02.22.44.11 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 02 Aug 2026 22:44:11 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-c16711b9473so274429666b.2 for ; Sun, 02 Aug 2026 22:44:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1785735850; x=1786340650; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:subject :user-agent:references:in-reply-to:message-id:date:cc:to:from:from :to:cc:subject:date:message-id:reply-to:content-type; bh=df1R3651GFZlufP+Sp9/jqANKcFbF/GkeE2awbI5Hgs=; b=PnWhTstwB6GTPm+7ZWf5nCyzXES3Ag+gUw4MegEjp1Pj5YESi12kdGVHFntcwU1Dmm NaVbyzYw3Lk5GsVjspuiiMRc+8UTxMWqdYD0VblyG+L96Y0Ol5UMsEIAtAtI4Vvfm8U2 H+hufJ6Jyfoqs0swJTsNDjAMUo0feP3Mn7RBk= X-Forwarded-Encrypted: i=1; AHgh+Rqfz+XZgUCGS3YxrKHBctbmKPP5wuA0IG3NqbgYUPfGyKO345CozoJGl6J0oMP4C5XowD0vLMQcn91ZDVk=@vger.kernel.org X-Received: by 2002:a17:906:f1cf:b0:c16:8931:245c with SMTP id a640c23a62f3a-c1fe81e1316mr455359266b.21.1785735849949; Sun, 02 Aug 2026 22:44:09 -0700 (PDT) X-Received: by 2002:a17:906:f1cf:b0:c16:8931:245c with SMTP id a640c23a62f3a-c1fe81e1316mr455357966b.21.1785735849510; Sun, 02 Aug 2026 22:44:09 -0700 (PDT) Received: from [192.168.178.59] (f215227.upc-f.chello.nl. [80.56.215.227]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c1fd4537755sm496563766b.54.2026.08.02.22.44.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 02 Aug 2026 22:44:09 -0700 (PDT) From: Arend van Spriel To: Johannes Berg , Abdun Nihaal CC: , , , , Date: Mon, 03 Aug 2026 07:44:08 +0200 Message-ID: <19fc626a040.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com> In-Reply-To: <6648c1d61a44ad732550ff20c0b1aecaa43676f6.camel@sipsolutions.net> References: <20260722110713.115988-1-nihaal@cse.iitm.ac.in> <20260802083905.3819981-2-arend.vanspriel@broadcom.com> <6648c1d61a44ad732550ff20c0b1aecaa43676f6.camel@sipsolutions.net> User-Agent: AquaMail/1.59.0 (build: 105900627) Subject: Re: [PATCH] wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="us-ascii" Content-Transfer-Encoding: 8bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e Op 2 augustus 2026 18:44:40 schreef Johannes Berg : > On Sun, 2026-08-02 at 18:41 +0200, Johannes Berg wrote: >> On Sun, 2026-08-02 at 10:38 +0200, Arend van Spriel wrote: >>> On Wed, 22 Jul 2026 16:37:12 +0530, Abdun Nihaal wrote: >>>> The memory allocated for buf is not freed in some of the error paths in >>>> brcmf_sdio_read_control(). Fix that by adding vfree() calls. >>>> >>>> Fixes: dd43a01c5cdb ("brcmfmac: use dynamically allocated control frame >>>> buffer") >>>> Cc: stable@vger.kernel.org >>>> Signed-off-by: Abdun Nihaal >>>> --- >>>> Compile tested only. Issue found using static analysis. >>>> >>>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++ >>>> 1 file changed, 3 insertions(+) >>> >>> To be applied to wireless tree. >> >> I'm going to put this into wireless-next, at this point (-rc6) this just >> doesn't cut it, the commit message makes it sound purely theoretical. > > Actually, I'm not even going to do that - sprinkling vfree()s over the > code when moving the one that exists would be sufficient is, and I'm > being generous here, not a good change. Sorry, Johannes I looked at moving the vfree() to the done: label, but the code also gets there in the success path to wakeup waiters. In the success path the buf is stored for further processing so it should not be freed. Maybe better to do: spin_unlock_bh(&bus->rxctl_lock); brcmf_sdio_dcmd_resp_wake(bus); return; fail: vfree(buf); /* Awake any waiters */ brcmf_sdio_dcmd_resp_wake(bus); } Gr. AvS