On Sat, Dec 01, 2018 at 10:14:38AM +0100, Benjamin Baier wrote: > On Fri, 30 Nov 2018 16:55:42 +0100 > Alexandre Ratchov <[email protected]> wrote: > > > On Fri, Nov 30, 2018 at 01:49:56PM +0100, Benjamin Baier wrote: > > > Hi > > > > > > There is a leak of *arg in > > > dev/usb/if_athn_usb.c:athn_usb_newauth() line 1263 > > > since Rev. 1.49 > > > Because athn_usb_do_async() memcpy's the argument anyway. > > > > > > Found with llvm/scan-build. > > > > > > Instead of adding free(arg) I opted to make this function > > > more like the other ones which call athn_usb_do_async. > > > > > > > Hi, > > > > AFAICS, athn_usb_do_async() will schedule a call to > > athn_usb_newauth_cb(), which will use arg after the functin has > > returned. The arg memory location must stay valid after return from > > athn_usb_newauth(). So we can neither use free() nor a local variable. > > athn_usb_do_async() takes care of that by memcpy-ing arg to cmd->data > before calling usb_add_task(). > > other calls to athn_usb_do_async() do use local variables. > if_athn_usb.c:1032:athn_usb_do_async(usc, athn_usb_newstate_cb, &cmd, > sizeof(cmd)); > if_athn_usb.c:1317:athn_usb_do_async(usc, athn_usb_ampdu_tx_start_cb, &cmd, > sizeof(cmd)); > if_athn_usb.c:1641:athn_usb_do_async(usc, athn_usb_set_key_cb, &cmd, > sizeof(cmd)); > if_athn_usb.c:1673:athn_usb_do_async(usc, athn_usb_delete_key_cb, &cmd, > sizeof(cmd)); >
You're right, I missed the memcpy() call, sorry. Your diff is correct.
