On Wed, Sep 26, 2018 at 10:52 AM, <valdis.kletnieks@vt.edu> wrote:
John notes that if the kzalloc of ieee->pHTInfo fails, we fail to call ieee80211_networks_free(). In addition, that function has an un-needed check before kfree().
Reported-by: John Whitmore <arigead@gmail.com> Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Reviewed-by: Kees Cook <keescook@chromium.org> (And this seems to be the only case of this -- I don't see this code trivially copy/pasted in other 80211 stacks.) -Kees
--- diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c index 90a097f2cd4e..97ff0371b5bb 100644 --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c @@ -78,8 +78,6 @@ static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
static inline void ieee80211_networks_free(struct ieee80211_device *ieee) { - if (!ieee->networks) - return; kfree(ieee->networks); ieee->networks = NULL; } @@ -180,6 +178,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv) return dev;
failed: + ieee80211_networks_free(ieee); if (dev) free_netdev(dev);
-- Kees Cook Pixel Security