From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f99.google.com (mail-qv1-f99.google.com [209.85.219.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF37E3AEF57 for ; Mon, 3 Aug 2026 08:21:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.99 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785745271; cv=none; b=jrR/JX4FK0WYa4LpqyTlAuqDHk660xAkqQKrLW5YJXSdBZ6XKobSYxE9EJKraYezRL/VxlbMztsKXo8PYBkiWHrNsjMuv+A08NiH/0WacFwl9LOiaMeW13dzUgPPfE3uGGvlsxfLMFb/6x3UyzbaHVlFe90HCv9LtzkW1DUEtGY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785745271; c=relaxed/simple; bh=Pg0dLujnHeta+8k9PUkwaeX7IBhCH3Vp8JK79I4o2qs=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=ATbwLXC1Sjswj1arK1eIzvJ4S8uR2a72QbgvZb4VrEoDFLLdYwdciPFkJfPuOeHXg35gmS9YcjPoUR/HE4O32lGsmXs/pdwit8gBPldwKV/lEadYQE1pnY97SkizzRgJ54iWj3JDyCDyZXROmJGKZndJfrhgtadMlICx6ce5Rxw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=S/vNP+dB; arc=none smtp.client-ip=209.85.219.99 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="S/vNP+dB" Received: by mail-qv1-f99.google.com with SMTP id 6a1803df08f44-8f256eaedf8so27702886d6.2 for ; Mon, 03 Aug 2026 01:21:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785745268; x=1786350068; h=content-transfer-encoding:content-type:in-reply-to:content-language :references:cc:to:from:subject:user-agent:mime-version:date :message-id:dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=umawf+BlMbUojF4hA2eaASvm/LHe9PC11Jo6AdX6bp8=; b=nwmT2OLFnV07E7JNwaRNbEEDn1lNk8huRgImHPeXSfqzYl7Kfqhi5nbuYmjeQTiIjs gslWpCZR18KauQrBy9m8aLKqeDIO7rq1IoGSOtKkHOYIj3yrGYQvQ6+bNLATxeJvCKv4 FWGt3lZG1T0qKWsaINyZiA8ktQrbxvjIFO5v2shcawPsci3pZNT9/QrcA+nFLDqIz93E sdCvj5x7fIkHjnJrafO7e9l/peEhbKZ5Mevj8M8xkk7wTdMBc/YLM31eI/kIvlEvmkzn b0POv/r1BoskbJoDomHcsTxCcLWp0Z2825CJ5qbUB7X66B/Wzfx8mY+yxk3+yX43p4H5 j0wg== X-Forwarded-Encrypted: i=1; AHgh+RoM9XrWGMMNWpO+PZfXRt668BXZRrWVXARdbICplETNtxeSTo56bGsbf2V4BZMmXkrNokN98mK+ThjLr0A=@vger.kernel.org X-Gm-Message-State: AOJu0YxLFHkXeZXnV7OEBs7U8/v3rmfsHhmkA6QuzVJaYmQdPXUpZ6pS 6GVHKcuoTMR6bWpl0RWx60QkQfaBoSajjYj3ZOIem7n9Q+1WZf8p4GGoEl/44dpODlqvLWkYcyf pjuQhfV5pjKGGgIL23zzj8wfw/IhTfw+xgpRun9EWBt7jKQ0BbnKUZ7n0NB9kpH7mepgnb559Ec 6wH5TMT9+LbZSVh2on3PSz9NSNvq6a4FkuRxA+dWk+37D3xYg9Qgvtohx0x6txKnHbZ21tsCWa5 cB9YrzJhMDl3YQHiXMWFJXcvw== X-Gm-Gg: AR+sD10J3bRzODJ2Ym/1+WN2/l/hQay2oOdggd1F+QKIxW9FQ0CjGZnQCTn1rXVDxr7 YVNj7qB2rUP60J7pfFdesV+brLhXb4Xa7x+zv9HuVi8RGA2VoWd5qkVEZ0kMwEGfHfBcRGFOrTq V6awrmoPFrn1ksJQ1PMZKlF/Hi886gmxIBs48+7fzQIUrNpNGkdFH7zV/W6QFqwIjWrhNjhur4N SXMalAq+xmq5I5dPYznncyjJPcGo5ZNnHRFE/fgcbD2Rq7eMra6zYrmIxHR3tyJlJvMZgiiYIEW IcxYJ2+V4d3f156dl8zdwQJDQ9gx3NXqJu9gudwnnTbr+AbRirl1wLUJ6jF3QD7U6xMpCwRreX5 HEQSJORJijv5zQBNsuR82inCiEQhHQM8h454Q7jIsu03Z8XrZMuaXhDpuSfEPwqIMQ3ZaXplXtd e2VsnpfeKeQCVNxTQujoAyMWDpY/NSsuHS1B8zQB4= X-Received: by 2002:a05:6214:5b88:b0:8f7:43f4:fe8d with SMTP id 6a1803df08f44-9084966f7e3mr185570046d6.29.1785745268378; Mon, 03 Aug 2026 01:21:08 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-26.dlp.protect.broadcom.com. [144.49.247.26]) by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-908436032a1sm5886706d6.28.2026.08.03.01.21.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Aug 2026 01:21:08 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-38e1118e4abso5836595a91.0 for ; Mon, 03 Aug 2026 01:21:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1785745266; x=1786350066; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :references:cc:to:from:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=umawf+BlMbUojF4hA2eaASvm/LHe9PC11Jo6AdX6bp8=; b=S/vNP+dB2r8dfC99LwWLupiUUelWHCzPGrii4uDLA7/qrFOK/BB2g4nsOt3Hq2yrZq 8grCzW3/DlwIZmDvFHl/ZpYzxndP1rIF16+/+oJyH2mRTiKXMfjVgC1s1S4D+W0ZPEfB Z0nwcSMxoX9LtVgZCiB6i2VJCG9p9iBhd3DgU= X-Forwarded-Encrypted: i=1; AHgh+RohjaxzFIxrnWSKqa1V/9aNKfEN0h/2REHVXoUbA60B/1By4hEUV5i4Rhu0i5wH/i48NoQzsRyeeSxPdNY=@vger.kernel.org X-Received: by 2002:a17:90b:4f48:b0:381:c500:b0d1 with SMTP id 98e67ed59e1d1-38fbc4ff4ccmr8731217a91.20.1785745265911; Mon, 03 Aug 2026 01:21:05 -0700 (PDT) X-Received: by 2002:a17:90b:4f48:b0:381:c500:b0d1 with SMTP id 98e67ed59e1d1-38fbc4ff4ccmr8731186a91.20.1785745265384; Mon, 03 Aug 2026 01:21:05 -0700 (PDT) Received: from [10.176.2.103] ([192.19.176.250]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3153dd9be04sm33069820eec.9.2026.08.03.01.21.03 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 03 Aug 2026 01:21:04 -0700 (PDT) Message-ID: Date: Mon, 3 Aug 2026 10:21:03 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() From: Arend van Spriel To: Johannes Berg , Abdun Nihaal Cc: linux-wireless@vger.kernel.org, brcm80211@lists.linux.dev, brcm80211-dev-list.pdl@broadcom.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org References: <20260722110713.115988-1-nihaal@cse.iitm.ac.in> <20260802083905.3819981-2-arend.vanspriel@broadcom.com> <6648c1d61a44ad732550ff20c0b1aecaa43676f6.camel@sipsolutions.net> <19fc626a040.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com> Content-Language: en-US In-Reply-To: <19fc626a040.2873.9b12b7fc0a3841636cfb5e919b41b954@broadcom.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e On 03/08/2026 07:44, Arend van Spriel wrote: > Op 2 augustus 2026 18:44:40 schreef Johannes Berg > : > >> On Sun, 2026-08-02 at 18:41 +0200, Johannes Berg wrote: >>> On Sun, 2026-08-02 at 10:38 +0200, Arend van Spriel wrote: >>>> On Wed, 22 Jul 2026 16:37:12 +0530, Abdun Nihaal >>>> wrote: >>>>> The memory allocated for buf is not freed in some of the error >>>>> paths in >>>>> brcmf_sdio_read_control(). Fix that by adding vfree() calls. >>>>> >>>>> Fixes: dd43a01c5cdb ("brcmfmac: use dynamically allocated control >>>>> frame buffer") >>>>> Cc: stable@vger.kernel.org >>>>> Signed-off-by: Abdun Nihaal >>>>> --- >>>>> Compile tested only. Issue found using static analysis. >>>>> >>>>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++ >>>>> 1 file changed, 3 insertions(+) >>>> >>>> To be applied to wireless tree. >>> >>> I'm going to put this into wireless-next, at this point (-rc6) this just >>> doesn't cut it, the commit message makes it sound purely theoretical. >> >> Actually, I'm not even going to do that - sprinkling vfree()s over the >> code when moving the one that exists would be sufficient is, and I'm >> being generous here, not a good change. > > Sorry, Johannes > > I looked at moving the vfree() to the done: label, but the code also > gets there in the success path to wakeup waiters. In the success path > the buf is stored for further processing so it should not be freed. > Maybe better to do: > >        spin_unlock_bh(&bus->rxctl_lock); >        brcmf_sdio_dcmd_resp_wake(bus); >        return; > > fail: >        vfree(buf); >        /* Awake any waiters */ >        brcmf_sdio_dcmd_resp_wake(bus); > } Actually it turns out brcmf_sdio_read_control() is only called once so the brcmf_sdio_dcmd_resp_wake() can be taken outside the function. Gr. AvS