brcmfmac: Fix use after free in brcmf_sdio_readframes()

Dan Carpenter · Kalle Valo · commit 216b44000ada · 2019-12-18T20:58:11.000+02:00
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a static checker warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes() error: dereferencing freed memory 'pkt' It looks like there was supposed to be a continue after we free "pkt". Fixes: 4754fce ("brcmfmac: streamline SDIO read frame routine") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 					       BRCMF_SDIO_FT_NORMAL)) {
 				rd->len = 0;
 				brcmu_pkt_buf_free_skb(pkt);
+				continue;
 			}
 			bus->sdcnt.rx_readahead_cnt++;
 			if (rd->len != roundup(rd_new.len, 16)) {

Original file line number	Diff line number	Diff line change
`@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)`
`1935`	`1935`	`BRCMF_SDIO_FT_NORMAL)) {`
`1936`	`1936`	`rd->len = 0;`
`1937`	`1937`	`brcmu_pkt_buf_free_skb(pkt);`
	`1938`	`+ continue;`
`1938`	`1939`	`}`
`1939`	`1940`	`bus->sdcnt.rx_readahead_cnt++;`
`1940`	`1941`	`if (rd->len != roundup(rd_new.len, 16)) {`