| From foo@baz Sun May 27 17:33:38 CEST 2018 |
| From: "weiyongjun (A)" <weiyongjun1@huawei.com> |
| Date: Thu, 18 Jan 2018 02:23:34 +0000 |
| Subject: mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() |
| |
| From: "weiyongjun (A)" <weiyongjun1@huawei.com> |
| |
| [ Upstream commit 0ddcff49b672239dda94d70d0fcf50317a9f4b51 ] |
| |
| 'hwname' is malloced in hwsim_new_radio_nl() and should be freed |
| before leaving from the error handling cases, otherwise it will cause |
| memory leak. |
| |
| Fixes: ff4dd73dd2b4 ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length") |
| Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> |
| Reviewed-by: Ben Hutchings <ben.hutchings@codethink.co.uk> |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/wireless/mac80211_hwsim.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/wireless/mac80211_hwsim.c |
| +++ b/drivers/net/wireless/mac80211_hwsim.c |
| @@ -3084,8 +3084,10 @@ static int hwsim_new_radio_nl(struct sk_ |
| if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) { |
| u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]); |
| |
| - if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) |
| + if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) { |
| + kfree(hwname); |
| return -EINVAL; |
| + } |
| param.regd = hwsim_world_regdom_custom[idx]; |
| } |
| |
