Skip to content

Commit cf0c2a5

Browse files
LeoBriandFiveOMaureenHelm
authored andcommitted
drivers: wifi: eswifi: Fix memory buffer allocation in off_read_work
When receiving data over the eswifi module, we currently read the data first, then allocate a buffer, and finally write the data into the buffer. The issue is that if we can't allocate the buffer, the data that was read is lost. To fix this, we should first attempt to allocate the buffer before reading any data. If we can't allocate the buffer, we should not proceed with reading the data. By allocating a buffer with the MTU size, we can read the packet, write it into the allocated buffer and then resize by removing unused allocated buffer with net_pkt_trim_buffer(). Signed-off-by: Léo BRIAND <[email protected]>
1 parent 36a1cac commit cf0c2a5

File tree

1 file changed

+14
-7
lines changed

1 file changed

+14
-7
lines changed

drivers/wifi/eswifi/eswifi_socket.c

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -133,33 +133,40 @@ static void eswifi_off_read_work(struct k_work *work)
133133

134134
__select_socket(eswifi, socket->index);
135135

136+
/* Verify if we can allocate a rx packet before reading data to prevent leaks */
137+
pkt = net_pkt_rx_alloc_with_buffer(eswifi->iface, 1460,
138+
AF_UNSPEC, 0, K_NO_WAIT);
139+
if (!pkt) {
140+
LOG_ERR("Cannot allocate rx packet");
141+
goto done;
142+
}
143+
136144
len = __read_data(eswifi, 1460, &data); /* 1460 is max size */
137145
if (len < 0) {
138146
__stop_socket(eswifi, socket);
139147

140148
if (socket->recv_cb) {
141149
/* send EOF (null pkt) */
150+
net_pkt_unref(pkt);
151+
pkt = NULL;
142152
goto do_recv_cb;
143153
}
144154
}
145155

146156
if (!len || !socket->recv_cb) {
157+
net_pkt_unref(pkt);
147158
goto done;
148159
}
149160

150161
LOG_DBG("payload sz = %d", len);
151162

152-
pkt = net_pkt_rx_alloc_with_buffer(eswifi->iface, len,
153-
AF_UNSPEC, 0, K_NO_WAIT);
154-
if (!pkt) {
155-
LOG_ERR("Cannot allocate rx packet");
156-
goto done;
157-
}
158-
159163
if (net_pkt_write(pkt, data, len) < 0) {
160164
LOG_WRN("Incomplete buffer copy");
161165
}
162166

167+
/* Resize the packet */
168+
net_pkt_trim_buffer(pkt);
169+
163170
net_pkt_cursor_init(pkt);
164171

165172
do_recv_cb:

0 commit comments

Comments
 (0)