brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach
authorWang Yufen <wangyufen@huawei.com>
Mon, 20 Jul 2020 09:36:05 +0000 (17:36 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 18 Aug 2020 12:46:15 +0000 (15:46 +0300)
When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL,
we should destroy the workqueue.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1595237765-66238-1-git-send-email-wangyufen@huawei.com
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

index f1a20db8daab9a3ec235f34937b53689c3a1de44..bfddb851e386e1cdc4a3fb4c94e4333cd63f367b 100644 (file)
@@ -1620,6 +1620,8 @@ fail:
                                          BRCMF_TX_IOCTL_MAX_MSG_SIZE,
                                          msgbuf->ioctbuf,
                                          msgbuf->ioctbuf_handle);
+               if (msgbuf->txflow_wq)
+                       destroy_workqueue(msgbuf->txflow_wq);
                kfree(msgbuf);
        }
        return -ENOMEM;