diff options
| author | Lv Yunlong <[email protected]> | 2021-04-02 22:47:55 -0700 |
|---|---|---|
| committer | Luca Coelho <[email protected]> | 2021-12-07 13:10:10 +0200 |
| commit | f973795a8d19cbf3d03807704eb7c6ff65788d5a (patch) | |
| tree | 80e0c249bc7db4e8df1803a279c3013641a8f477 | |
| parent | 46c7b05a4f91f425d429bbe152c0185e9f8a5d18 (diff) | |
wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma
In iwl_txq_dyn_alloc_dma, txq->tfds is freed at first time by:
iwl_txq_alloc()->goto err_free_tfds->dma_free_coherent(). But
it forgot to set txq->tfds to NULL.
Then the txq->tfds is freed again in iwl_txq_dyn_alloc_dma by:
goto error->iwl_txq_gen2_free_memory()->dma_free_coherent().
My patch sets txq->tfds to NULL after the first free to avoid the
double free.
Fixes: 0cd1ad2d7fd41 ("iwlwifi: move all bus-independent TX functions to common code")
Signed-off-by: Lv Yunlong <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Luca Coelho <[email protected]>
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/queue/tx.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/queue/tx.c b/drivers/net/wireless/intel/iwlwifi/queue/tx.c index 451b06069350..0f3526b0c5b0 100644 --- a/drivers/net/wireless/intel/iwlwifi/queue/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/queue/tx.c @@ -1072,6 +1072,7 @@ int iwl_txq_alloc(struct iwl_trans *trans, struct iwl_txq *txq, int slots_num, return 0; err_free_tfds: dma_free_coherent(trans->dev, tfd_sz, txq->tfds, txq->dma_addr); + txq->tfds = NULL; error: if (txq->entries && cmd_queue) for (i = 0; i < slots_num; i++) |