On Tue, Sep 22, 2015 at 12:24:50PM +0200, Javier Martinez Canillas wrote: > The wilc_wlan_cleanup() function iterates over the list of transmission > buffers freeing all of them and then iterates over the receive buffers > list to free all of them as well. > > But on the receive loop a pointer to struct txq_entry_t is dereferenced > instead of the pointer to a struct rxq_entry_t. This not only causes a > dereference to a pointer already freed but also leaks the memory in the > struct rxq_entry_t buffer. > > Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") > Signed-off-by: Javier Martinez Canillas <javier@xxxxxxxxxxxxxxx> > > --- > > drivers/staging/wilc1000/wilc_wlan.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c > index 4c25179c2fec..c40f143b00b7 100644 > --- a/drivers/staging/wilc1000/wilc_wlan.c > +++ b/drivers/staging/wilc1000/wilc_wlan.c > @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void) > if (rqe == NULL) > break; > #ifdef MEMORY_DYNAMIC > - kfree(tqe->buffer); > + kfree(rqe->buffer); > #endif MEMORY_DYNAMIC is only used here and no where else. And buffer was allocated in the else part of #ifdef MEMORY_STATIC. So you should really be using #ifndef MEMORY_STATIC here instead of #ifdef MEMORY_DYNAMIC otherwise memory leak will still remain. regards sudip _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel