From nobody Mon Feb 9 07:31:44 2026 Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 019EE30ACED for ; Fri, 14 Nov 2025 09:45:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763113544; cv=none; b=FZaZceyxDK58k/tYlRRh1bMx0nLhrjJwKqYvK1xeLVBKQg2fnG7TbPaKx2I9gBPzE1bru3Vwca7Lm06vj1yo47G4LGdKa49O+Mh2HMdu9j5A+8wne8NfeCzIhaJMuypqKz1Jo63u9P94l+dlxsEmgGChshvmEj7CSw1g9In6xgg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763113544; c=relaxed/simple; bh=/v95hXtiMNtokXdEjGGjh7v6qZAmq6GB9grj7w5PDjw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sIOThNCKm/TGvUp2hHMuFHpmrF7R5ILLLhFkybgsGKFrY3dk5gE10TQGUI6R+JgUMTFBUdsEIbVGab4JBgVoARrffFDFbKmRs3ETzk86BEw7cndpyWjQ6L0O3W9Rr2177Lx55qykS15A88wX536N1yrc3mi5F1FhUxcyGSXz8V0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in; spf=pass smtp.mailfrom=cse.iitm.ac.in; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20230601.gappssmtp.com header.i=@cse-iitm-ac-in.20230601.gappssmtp.com header.b=nnJEeXPN; arc=none smtp.client-ip=209.85.214.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cse.iitm.ac.in Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cse-iitm-ac-in.20230601.gappssmtp.com header.i=@cse-iitm-ac-in.20230601.gappssmtp.com header.b="nnJEeXPN" Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-29586626fbeso18243695ad.0 for ; Fri, 14 Nov 2025 01:45:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cse-iitm-ac-in.20230601.gappssmtp.com; s=20230601; t=1763113541; x=1763718341; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=nYdcmg/EanAelwRsGB72V2V0TYhuxD+KsCswGlWW8ZM=; b=nnJEeXPNCmhrpaEBAy6elOMksCMn8xA/HcJDT4QyezdMYOnSos+0dgL+0N0c9Cr+55 EIAt+YKfDJgp5QMnjKmjDeHKjxbMFGSltWKRf2qsLf2WJ3f1XupWdlWwcjO2sODS6LAp 5iLtZifPI2nVZ90iXvgORO3dc/D3f8fx4mJiGWfMNaSIZTA4+VEMNniuS7MFqw3GNSiC YjQQek2k64iMi6m0NAK3vn23EUQ0jx9XYRQFRmdLddtKoxT1q6EMtKApYb4WEPITvVnF btwosuF2YfcZDVKAWuzVtxI07rwFmVVwcZwfv+uxfcd+vQokaQ+s12vyRVVa1QDlqVyW AMLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763113541; x=1763718341; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=nYdcmg/EanAelwRsGB72V2V0TYhuxD+KsCswGlWW8ZM=; b=BRoZPHS6kqH8CcIrQyDwQbwGHwxQo7bPuKGODtEGVlDFmIAzIAe6b0j0i5gkOWgMF3 9WLVKs6OIIMzABvfBTKrTH1kRagyUZ6dB+T0oPR5SZDHEsPvof6mberJP8mgFA4ppM1x kXp09PqKLg80vKkZFrPRIn4errTspssQphTBgUnAGsMzvyw0oaCCjtpXXb6G/6Uv5rLs MxFZlzOHNBWEyMsO4j7xYKaTvxPhm3d4VzE3ZTzsqZYibHgydynw0rfQkd8GSxHQPkSi bboPwjOeo1YfSBkuXgYF5iqPBM1o+0lve54QUQKwGgsAI5/7l4AaSxx/YuqYXq4Wbqub D0Ow== X-Forwarded-Encrypted: i=1; AJvYcCW8V/AjM+QRfLfhUuzOMDSojWjSSj2wru7wcm7EVuFSQabgKXw5LhgBMAQcldtBdnJZOouOtq4Washn3ok=@vger.kernel.org X-Gm-Message-State: AOJu0Yy49MLgD61C2uy7ltlJqgB98o8LMvEU4Y2MBRfY1IB96/Jvm54m q2hcyCWNoJAXCop6HfoywZTmUTZxDhBzXBjJeO5t2izSUPyrtZgvOwheBlwvNGI/QhE= X-Gm-Gg: ASbGnct/GqSYYeodn1kEigEs+Rn40+cDbJ9PHWke8LGRYkQ7i4oIIQA2vi5LkPFbfYb kXLa+MeOSM+ixRJAZouXaAo+FwxO0pnJGPKSeo6IpAvXKxh9gcH5iqNCY09yyJlov201SnYRQdS +qVyKuLDDzK5bvFswOv5FiveClOdvgm4AArdN9mNj/1ISRYwx+y5iI9tgkjCT9x7orodN3Crxdm s5kMSrrkr8XdQUHSd3DlefWW1+SEDKODn67jPlKTjKZUP1xxaeo4OSL79NjRebY6ihy75hgYkJy pDYJqNC5wadbv6M+wehULPT5aSU/hmiNhrbL0TE9jJHXORE9CbRPsXnZPZU6XefP7UMEvfKY4xg rBK/zxY7lBy0CFfphFRTov70+vfls/97edk7a1/poAlxpzG5TbGvs25y0vSLNBbfm7YZFl2FmBs Q28h9HCXqC2qBv0dQAN2/5QJAmO2h8PxQadCk= X-Google-Smtp-Source: AGHT+IGTHxgQ91mqlnu4ODmMQ4fLQ5T7yFXMw8D7cdVyAgnfmSNyWAX4we6ymVTehkLjKlRgVXG6Cw== X-Received: by 2002:a17:903:fad:b0:297:d45b:6d97 with SMTP id d9443c01a7336-2986a6d36a1mr23962645ad.14.1763113541235; Fri, 14 Nov 2025 01:45:41 -0800 (PST) Received: from localhost.localdomain ([103.158.43.25]) by smtp.googlemail.com with ESMTPSA id d9443c01a7336-2985c234644sm49725305ad.10.2025.11.14.01.45.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Nov 2025 01:45:40 -0800 (PST) From: Abdun Nihaal To: Ping-Ke Shih , linux-wireless@vger.kernel.org Cc: Abdun Nihaal , linux-kernel@vger.kernel.org Subject: [PATCH v2] rtl818x_pci: Fix potential memory leaks in rtl8180_init_rx_ring() Date: Fri, 14 Nov 2025 15:15:26 +0530 Message-ID: <20251114094527.79842-1-nihaal@cse.iitm.ac.in> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit. Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the freed priv->rx_buf entry to null, to avoid double free. Fixes: f653211197f3 ("Add rtl8180 wireless driver") Signed-off-by: Abdun Nihaal Reviewed-by: Ping-Ke Shih --- v1->v2: - Use rtl8180_free_rx_ring() to free the buffers by jumping to err_free_rings label, as suggested by Ping-Ke Shih. - Remove free of rx_ring and set the freed priv->rx_buf entry to null, in the error path to avoid it getting freed again in=20 rtl8180_free_rx_ring() Calling rtl8180_free_rx_ring() directly in rtl8180_init_rx_ring() requires moving the free function before (implicit declaration error). So in order to minimize the code change, I used the err_free_rings label as suggested by Ping-Ke Shih. Link to v1: https://lore.kernel.org/all/20251113165851.39054-1-nihaal@cse.iitm.ac.in/ drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/n= et/wireless/realtek/rtl818x/rtl8180/dev.c index 2905baea6239..070c0431c482 100644 --- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c @@ -1023,9 +1023,6 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *= dev) dma_addr_t *mapping; entry =3D priv->rx_ring + priv->rx_ring_sz*i; if (!skb) { - dma_free_coherent(&priv->pdev->dev, - priv->rx_ring_sz * 32, - priv->rx_ring, priv->rx_ring_dma); wiphy_err(dev->wiphy, "Cannot allocate RX skb\n"); return -ENOMEM; } @@ -1037,9 +1034,7 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *= dev) =20 if (dma_mapping_error(&priv->pdev->dev, *mapping)) { kfree_skb(skb); - dma_free_coherent(&priv->pdev->dev, - priv->rx_ring_sz * 32, - priv->rx_ring, priv->rx_ring_dma); + priv->rx_buf[i] =3D NULL; wiphy_err(dev->wiphy, "Cannot map DMA for RX skb\n"); return -ENOMEM; } @@ -1130,7 +1125,7 @@ static int rtl8180_start(struct ieee80211_hw *dev) =20 ret =3D rtl8180_init_rx_ring(dev); if (ret) - return ret; + goto err_free_rings; =20 for (i =3D 0; i < (dev->queues + 1); i++) if ((ret =3D rtl8180_init_tx_ring(dev, i, 16))) --=20 2.43.0