OSDN Git Service

brcmfmac: Fix use after free in brcmf_sdio_readframes()
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 3 Dec 2019 09:58:55 +0000 (12:58 +0300)
committerKalle Valo <kvalo@codeaurora.org>
Wed, 18 Dec 2019 18:58:11 +0000 (20:58 +0200)
commit216b44000ada87a63891a8214c347e05a4aea8fe
tree11eb869af3a0b0cf6ba76d7ca363a73ca0cfef37
parent960da557f435bfe14edb160a42b8ed3a2e255e73
brcmfmac: Fix use after free in brcmf_sdio_readframes()

The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:

    drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
    error: dereferencing freed memory 'pkt'

It looks like there was supposed to be a continue after we free "pkt".

Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c