| From 25c855ec69af3291801b51c8b56308f0d820565a Mon Sep 17 00:00:00 2001 |
| From: YueHaibing <yuehaibing@huawei.com> |
| Date: Tue, 12 Mar 2019 15:03:58 +0800 |
| Subject: mwifiex: Fix mem leak in mwifiex_tm_cmd |
| |
| [ Upstream commit 003b686ace820ce2d635a83f10f2d7f9c147dabc ] |
| |
| 'hostcmd' is alloced by kzalloc, should be freed before |
| leaving from the error handling cases, otherwise it will |
| cause mem leak. |
| |
| Fixes: 3935ccc14d2c ("mwifiex: add cfg80211 testmode support") |
| Signed-off-by: YueHaibing <yuehaibing@huawei.com> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c |
| index c46f0a54a0c76..e582d9b3e50c2 100644 |
| --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c |
| +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c |
| @@ -4082,16 +4082,20 @@ static int mwifiex_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev, |
| |
| if (mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, true)) { |
| dev_err(priv->adapter->dev, "Failed to process hostcmd\n"); |
| + kfree(hostcmd); |
| return -EFAULT; |
| } |
| |
| /* process hostcmd response*/ |
| skb = cfg80211_testmode_alloc_reply_skb(wiphy, hostcmd->len); |
| - if (!skb) |
| + if (!skb) { |
| + kfree(hostcmd); |
| return -ENOMEM; |
| + } |
| err = nla_put(skb, MWIFIEX_TM_ATTR_DATA, |
| hostcmd->len, hostcmd->cmd); |
| if (err) { |
| + kfree(hostcmd); |
| kfree_skb(skb); |
| return -EMSGSIZE; |
| } |
| -- |
| 2.20.1 |
| |
