staging: rtl8712: fix a potential memory leak in r871xu_drv_init()

x2018 · gregkh · commit 7288ff561de6 · 2022-04-05T16:14:38.000+02:00
In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not properly released as there is no action will be performed by r8712_usb_dvobj_deinit(). To properly release it, we should call r8712_free_io_queue() in r8712_usb_dvobj_deinit(). Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called by r871x_dev_unload() under condition `padapter->bup` and r8712_free_io_queue() is called by r8712_free_drv_sw(). However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for better understading the code. So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove r8712_free_io_queue() from r8712_free_drv_sw(). Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Xiaoke Wang <xkernel.wang@foxmail.com> Link: https://lore.kernel.org/r/tencent_B8048C592777830380A23A7C4409F9DF1305@qq.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
@@ -332,7 +332,6 @@ void r8712_free_drv_sw(struct _adapter *padapter)
 	r8712_free_evt_priv(&padapter->evtpriv);
 	r8712_DeInitSwLeds(padapter);
 	r8712_free_mlme_priv(&padapter->mlmepriv);
-	r8712_free_io_queue(padapter);
 	_free_xmit_priv(&padapter->xmitpriv);
 	_r8712_free_sta_priv(&padapter->stapriv);
 	_r8712_free_recv_priv(&padapter->recvpriv);
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
@@ -265,6 +265,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)
 
 static void r8712_usb_dvobj_deinit(struct _adapter *padapter)
 {
+	r8712_free_io_queue(padapter);
 }
 
 void rtl871x_intf_stop(struct _adapter *padapter)
@@ -302,9 +303,6 @@ void r871x_dev_unload(struct _adapter *padapter)
 			rtl8712_hal_deinit(padapter);
 		}
 
-		/*s6.*/
-		if (padapter->dvobj_deinit)
-			padapter->dvobj_deinit(padapter);
 		padapter->bup = false;
 	}
 }
@@ -607,6 +605,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
 	/* Stop driver mlme relation timer */
 	r8712_stop_drv_timers(padapter);
 	r871x_dev_unload(padapter);
+	if (padapter->dvobj_deinit)
+		padapter->dvobj_deinit(padapter);
 	r8712_free_drv_sw(padapter);
 	free_netdev(pnetdev);
 

Original file line number	Diff line number	Diff line change
`@@ -265,6 +265,7 @@ static uint r8712_usb_dvobj_init(struct _adapter *padapter)`
`265`	`265`
`266`	`266`	`static void r8712_usb_dvobj_deinit(struct _adapter *padapter)`
`267`	`267`	`{`
	`268`	`+ r8712_free_io_queue(padapter);`
`268`	`269`	`}`
`269`	`270`
`270`	`271`	`void rtl871x_intf_stop(struct _adapter *padapter)`
`@@ -302,9 +303,6 @@ void r871x_dev_unload(struct _adapter *padapter)`
`302`	`303`	`rtl8712_hal_deinit(padapter);`
`303`	`304`	`}`
`304`	`305`
`305`		`- /s6./`
`306`		`- if (padapter->dvobj_deinit)`
`307`		`- padapter->dvobj_deinit(padapter);`
`308`	`306`	`padapter->bup = false;`
`309`	`307`	`}`
`310`	`308`	`}`
`@@ -607,6 +605,8 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)`
`607`	`605`	`/* Stop driver mlme relation timer */`
`608`	`606`	`r8712_stop_drv_timers(padapter);`
`609`	`607`	`r871x_dev_unload(padapter);`
	`608`	`+ if (padapter->dvobj_deinit)`
	`609`	`+ padapter->dvobj_deinit(padapter);`
`610`	`610`	`r8712_free_drv_sw(padapter);`
`611`	`611`	`free_netdev(pnetdev);`
`612`	`612`