From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27A10C4363C for ; Sun, 4 Oct 2020 13:19:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DA78720735 for ; Sun, 4 Oct 2020 13:19:47 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Yt1djlo7" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726165AbgJDNTq (ORCPT ); Sun, 4 Oct 2020 09:19:46 -0400 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:32212 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726073AbgJDNTo (ORCPT ); Sun, 4 Oct 2020 09:19:44 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1601817582; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc; bh=rgrRP/YTXU8zDHHZah13pYSFtC6P1oYXhuKtk3thRRw=; b=Yt1djlo7NasEVdIRH/81Ed78li5lUjZia+uHXWQrlQIBiWBRe/Nzazig0r1otzZNM3ztPR rPg4LEiP+sdw28F89i2k7vS8Qu/0B4nR+hXVC+FVXWXluYHsMJhkpVQKxvkmK6xr0NklBF FvPw9ldPbYbsPAKqKigaXjSwP1w4HOk= Received: from mail-qv1-f71.google.com (mail-qv1-f71.google.com [209.85.219.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-449-G8UvJukJNfSO-dzwcK8tkQ-1; Sun, 04 Oct 2020 09:19:41 -0400 X-MC-Unique: G8UvJukJNfSO-dzwcK8tkQ-1 Received: by mail-qv1-f71.google.com with SMTP id 99so4095789qva.1 for ; Sun, 04 Oct 2020 06:19:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=rgrRP/YTXU8zDHHZah13pYSFtC6P1oYXhuKtk3thRRw=; b=Fl5j+h8nx22QKVHi1bE0+9FhTtzcVB0XCwIk0U24SVK4iRqLjphqkMtss994vbQlth GI5BV9dJ++G1UAAo6LnAsAnsjcVMZOn3AulKFNPFf39WQl8FE/4a6ReNUL98QaJWQPl7 o+qZcycX+KfCvnxI91wdpRM4dOIdKtPqUExY69bgaCxX5KZSemRcqHMxnK8i+lcVNP3+ tCMRfjt1eJ+oeJyEjSaT67Q9vJZ7lGGV7xOwWnRaSglnsf3gGkxB72qfcA/Y+gYB7TCQ LF7yY25pjzqapD/HcuEX1wQgpdzzUk+zDagJoGiIhSbH+osWtpnpGOJ4OP8LS7Aj0AkB 3s8Q== X-Gm-Message-State: AOAM530IO6BU7DMQ/cQ5EaYg9dw/9p2vVa9YXa0XV35v8V1XROFnQRZd 8disBNuTVuRRPCace9D1IiQUegeixglMVycDtY7qEC8d40a49xV0yYwlqFwrNyQao76iL5zij4s t9Kl30AhCD3sMGpd5cajRTqTC X-Received: by 2002:ac8:4410:: with SMTP id j16mr10412027qtn.305.1601817580599; Sun, 04 Oct 2020 06:19:40 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyPVUB+BQ2zEs0jgpJsnX9LeCehIQzJydegR33P3TJAOehrv+31Xo/3GsZzzf3ZO8JTcvMgCg== X-Received: by 2002:ac8:4410:: with SMTP id j16mr10411990qtn.305.1601817580275; Sun, 04 Oct 2020 06:19:40 -0700 (PDT) Received: from trix.remote.csb (075-142-250-213.res.spectrum.com. [75.142.250.213]) by smtp.gmail.com with ESMTPSA id w4sm2657150qtb.0.2020.10.04.06.19.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 04 Oct 2020 06:19:39 -0700 (PDT) From: trix@redhat.com To: amitkarwar@gmail.com, ganapathi.bhat@nxp.com, huxinming820@gmail.com, kvalo@codeaurora.org, davem@davemloft.net, kuba@kernel.org, natechancellor@gmail.com, ndesaulniers@google.com, linville@tuxdriver.com, nishants@marvell.com, rramesh@marvell.com, bzhao@marvell.com, frankh@marvell.com Cc: linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, clang-built-linux@googlegroups.com, Tom Rix Subject: [PATCH] wireless: mwifiex: fix double free Date: Sun, 4 Oct 2020 06:19:31 -0700 Message-Id: <20201004131931.29782-1-trix@redhat.com> X-Mailer: git-send-email 2.18.1 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Rix clang static analysis reports this problem: sdio.c:2403:3: warning: Attempt to free released memory kfree(card->mpa_rx.buf); ^~~~~~~~~~~~~~~~~~~~~~~ When mwifiex_init_sdio() fails in its first call to mwifiex_alloc_sdio_mpa_buffer, it falls back to calling it again. If the second alloc of mpa_tx.buf fails, the error handler will try to free the old, previously freed mpa_rx.buf. Reviewing the code, it looks like a second double free would happen with mwifiex_cleanup_sdio(). So set both pointers to NULL when they are freed. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Tom Rix --- drivers/net/wireless/marvell/mwifiex/sdio.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c index 69911c728eb1..bde9e4bbfffe 100644 --- a/drivers/net/wireless/marvell/mwifiex/sdio.c +++ b/drivers/net/wireless/marvell/mwifiex/sdio.c @@ -2403,6 +2403,8 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter, kfree(card->mpa_rx.buf); card->mpa_tx.buf_size = 0; card->mpa_rx.buf_size = 0; + card->mpa_tx.buf = NULL; + card->mpa_rx.buf = NULL; } return ret; -- 2.18.1