This is a note to let you know that I've just added the patch titled brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: brcmsmac-free-packet-if-dma_mapping_error-fails-in-dma_rxfill.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 5c5fa1f464ac954982df1d96b9f9a5103d21aedd Mon Sep 17 00:00:00 2001 From: Florian Fainelli <f.fainelli@xxxxxxxxx> Date: Mon, 18 Jul 2016 16:24:35 -0700 Subject: brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill From: Florian Fainelli <f.fainelli@xxxxxxxxx> commit 5c5fa1f464ac954982df1d96b9f9a5103d21aedd upstream. In case dma_mapping_error() returns an error in dma_rxfill, we would be leaking a packet that we allocated with brcmu_pkt_buf_get_skb(). Reported-by: coverity (CID 1081819) Fixes: 67d0cf50bd32 ("brcmsmac: Fix WARNING caused by lack of calls to dma_mapping_error()") Signed-off-by: Florian Fainelli <f.fainelli@xxxxxxxxx> Acked-by: Arend van Spriel <arend@xxxxxxxxxxxx> Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/wireless/brcm80211/brcmsmac/dma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c +++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c @@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub) pa = dma_map_single(di->dmadev, p->data, di->rxbufsize, DMA_FROM_DEVICE); - if (dma_mapping_error(di->dmadev, pa)) + if (dma_mapping_error(di->dmadev, pa)) { + brcmu_pkt_buf_free_skb(p); return false; + } /* save the free packet pointer */ di->rxp[rxout] = p; Patches currently in stable-queue which might be from f.fainelli@xxxxxxxxx are queue-4.4/brcmfmac-fix-glob_skb-leak-in-brcmf_sdiod_recv_chain.patch queue-4.4/brcmsmac-free-packet-if-dma_mapping_error-fails-in-dma_rxfill.patch queue-4.4/brcmsmac-initialize-power-in-brcms_c_stf_ss_algo_channel_get.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html