wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()

Zhang Changzhong · Sasha Levin · commit 97837336adcf · 2023-03-10T11:38:13.000Z
[ Upstream commit 212fde3 ] The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only. Fixes: 270a6c1 ("brcmfmac: rework headroom check in .start_xmit()") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -333,6 +333,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
 			bphy_err(drvr, "%s: failed to expand headroom\n",
 				 brcmf_ifname(ifp));
 			atomic_inc(&drvr->bus_if->stats.pktcow_failed);
+			dev_kfree_skb(skb);
 			goto done;
 		}
 	}

Original file line number	Diff line number	Diff line change
`@@ -333,6 +333,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,`
`333`	`333`	`bphy_err(drvr, "%s: failed to expand headroom\n",`
`334`	`334`	`brcmf_ifname(ifp));`
`335`	`335`	`atomic_inc(&drvr->bus_if->stats.pktcow_failed);`
	`336`	`+ dev_kfree_skb(skb);`
`336`	`337`	`goto done;`
`337`	`338`	`}`
`338`	`339`	`}`