The memory allocated for buf is not freed in some of the error paths in brcmf_sdio_read_control(). Fix that by adding vfree() calls. Fixes: dd43a01c5cdb ("brcmfmac: use dynamically allocated control frame buffer") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal --- Compile tested only. Issue found using static analysis. drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c index b725c64e5b5c..0900211ba2fe 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c @@ -1792,6 +1792,7 @@ brcmf_sdio_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff) brcmf_err("%d-byte control read exceeds %d-byte buffer\n", rdlen, bus->sdiodev->bus_if->maxctl); brcmf_sdio_rxfail(bus, false, false); + vfree(buf); goto done; } @@ -1800,6 +1801,7 @@ brcmf_sdio_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff) len, len - doff, bus->sdiodev->bus_if->maxctl); bus->sdcnt.rx_toolong++; brcmf_sdio_rxfail(bus, false, false); + vfree(buf); goto done; } @@ -1813,6 +1815,7 @@ brcmf_sdio_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff) rdlen, sdret); bus->sdcnt.rxc_errors++; brcmf_sdio_rxfail(bus, true, true); + vfree(buf); goto done; } else memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen); -- 2.43.0