wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

Zhang Changzhong · Kalle Valo · commit 212fde3fe76e · 2022-12-22T18:07:22.000+02:00
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only. Fixes: 270a6c1 ("brcmfmac: rework headroom check in .start_xmit()") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -336,6 +336,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 			bphy_err(drvr, "%s: failed to expand headroom\n",
 				 brcmf_ifname(ifp));
 			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
+			dev_kfree_skb(skb);
 			goto done;
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -336,6 +336,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,`
`336`	`336`	`bphy_err(drvr, "%s: failed to expand headroom\n",`
`337`	`337`	`brcmf_ifname(ifp));`
`338`	`338`	`atomic_inc(&drvr->bus_if->stats.pktcow_failed);`
	`339`	`+ dev_kfree_skb(skb);`
`339`	`340`	`goto done;`
`340`	`341`	`}`
`341`	`342`	`}`