mwifiex: fix potential mem leak in .del_virtual_intf

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=98a4635bba7050afdbdce428cc44a0471779ffc5
Commit:     98a4635bba7050afdbdce428cc44a0471779ffc5
Parent:     d1af2943da89f180274c846d593049e464026baf
Author:     Amitkumar Karwar <akarwar at marvell.com>
AuthorDate: Thu Nov 14 19:10:40 2013 -0800
Committer:  John W. Linville <linville at tuxdriver.com>
CommitDate: Fri Nov 15 14:29:31 2013 -0500

    mwifiex: fix potential mem leak in .del_virtual_intf
    
    1) Currently we freeing wdev for each interface in driver unload
    path. We may leak memory if user have already deleted an interface.
    mwifiex_add_virtual_intf() allocates wdev structure. So it should
    be freed in mwifiex_del_virtual_intf().
    This will make sure that wdev will be freed when user deletes an
    interface and also in unload path.
    2) "priv->netdev->ieee80211_ptr" should also be cleared in
    mwifiex_del_virtual_intf.
    
    Signed-off-by: Amitkumar Karwar <akarwar at marvell.com>
    Signed-off-by: Bing Zhao <bzhao at marvell.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>
---
 drivers/net/wireless/mwifiex/cfg80211.c | 3 +++
 drivers/net/wireless/mwifiex/main.c     | 6 ------
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ccc9c08..aeaea0e 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -2310,7 +2310,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 		unregister_netdevice(wdev->netdev);
 
 	/* Clear the priv in adapter */
+	priv->netdev->ieee80211_ptr = NULL;
 	priv->netdev = NULL;
+	kfree(wdev);
+	priv->wdev = NULL;
 
 	priv->media_connected = false;
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 42d9a68..78e8a66 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -998,12 +998,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
 	wiphy_unregister(priv->wdev->wiphy);
 	wiphy_free(priv->wdev->wiphy);
 
-	for (i = 0; i < adapter->priv_num; i++) {
-		priv = adapter->priv[i];
-		if (priv)
-			kfree(priv->wdev);
-	}
-
 	mwifiex_terminate_workqueue(adapter);
 
 	/* Unregister device */