On Wed, Sep 26, 2018 at 10:52 AM, <valdis.kletnieks@xxxxxx> wrote:
> John notes that if the kzalloc of ieee->pHTInfo fails, we fail to call
> ieee80211_networks_free(). In addition, that function has an un-needed check
> before kfree().
>
> Reported-by: John Whitmore <arigead@xxxxxxxxx>
> Signed-off-by: Valdis Kletnieks <valdis.kletnieks@xxxxxx>
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
(And this seems to be the only case of this -- I don't see this code
trivially copy/pasted in other 80211 stacks.)
-Kees
> ---
> diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> index 90a097f2cd4e..97ff0371b5bb 100644
> --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> @@ -78,8 +78,6 @@ static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
>
> static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
> {
> - if (!ieee->networks)
> - return;
> kfree(ieee->networks);
> ieee->networks = NULL;
> }
> @@ -180,6 +178,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
> return dev;
>
> failed:
> + ieee80211_networks_free(ieee);
> if (dev)
> free_netdev(dev);
>
>
--
Kees Cook
Pixel Security
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
