diff options
| author | Amitkumar Karwar <akarwar@marvell.com> | 2013-11-15 04:10:40 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2013-11-15 20:29:31 +0100 |
| commit | 98a4635bba7050afdbdce428cc44a0471779ffc5 (patch) | |
| tree | 241dccc95a98c9d1f1d82941f79c1084904b3695 | |
| parent | mwifiex: fix NULL pointer dereference in mwifiex_fw_dpc (diff) | |
| download | linux-98a4635bba7050afdbdce428cc44a0471779ffc5.tar.xz linux-98a4635bba7050afdbdce428cc44a0471779ffc5.zip | |
mwifiex: fix potential mem leak in .del_virtual_intf
1) Currently we freeing wdev for each interface in driver unload
path. We may leak memory if user have already deleted an interface.
mwifiex_add_virtual_intf() allocates wdev structure. So it should
be freed in mwifiex_del_virtual_intf().
This will make sure that wdev will be freed when user deletes an
interface and also in unload path.
2) "priv->netdev->ieee80211_ptr" should also be cleared in
mwifiex_del_virtual_intf.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/mwifiex/cfg80211.c | 3 | ||||
| -rw-r--r-- | drivers/net/wireless/mwifiex/main.c | 6 |
2 files changed, 3 insertions, 6 deletions
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c index ccc9c0866b25..aeaea0e3b4c4 100644 --- a/drivers/net/wireless/mwifiex/cfg80211.c +++ b/drivers/net/wireless/mwifiex/cfg80211.c @@ -2310,7 +2310,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev) unregister_netdevice(wdev->netdev); /* Clear the priv in adapter */ + priv->netdev->ieee80211_ptr = NULL; priv->netdev = NULL; + kfree(wdev); + priv->wdev = NULL; priv->media_connected = false; diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c index 42d9a68f45de..78e8a6666cc6 100644 --- a/drivers/net/wireless/mwifiex/main.c +++ b/drivers/net/wireless/mwifiex/main.c @@ -998,12 +998,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem) wiphy_unregister(priv->wdev->wiphy); wiphy_free(priv->wdev->wiphy); - for (i = 0; i < adapter->priv_num; i++) { - priv = adapter->priv[i]; - if (priv) - kfree(priv->wdev); - } - mwifiex_terminate_workqueue(adapter); /* Unregister device */ |