moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

staging: r8188eu: fix memleak in rtw_wx_set_enc_ext

Browse Source 
commit 26f448371820cf733c827c11f0c77ce304a29b51 upstream.

Free the param struct if the caller sets an unsupported algorithm
and we return an error.

Fixes: 2b42bd58b3 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211019202356.12572-1-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Martin Kaiser
2021-10-19 22:23:56 +02:00
committed by Greg Kroah-Hartman
parent 8f60f9f6ee
commit 4787caef52
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/staging/r8188eu/os_dep/ioctl_linux.c
View File

@@ -1978,7 +1978,7 @@ static int rtw_wx_set_enc_ext(struct net_device *dev,
struct ieee_param *param = NULL; struct ieee_param *param = NULL;
struct iw_point *pencoding = &wrqu->encoding; struct iw_point *pencoding = &wrqu->encoding;
struct iw_encode_ext *pext = (struct iw_encode_ext *)extra; struct iw_encode_ext *pext = (struct iw_encode_ext *)extra;
int ret = 0; int ret = -1;
param_len = sizeof(struct ieee_param) + pext->key_len; param_len = sizeof(struct ieee_param) + pext->key_len;
param = kzalloc(param_len, GFP_KERNEL); param = kzalloc(param_len, GFP_KERNEL);
@@ -2004,7 +2004,7 @@ static int rtw_wx_set_enc_ext(struct net_device *dev,
alg_name = "CCMP"; alg_name = "CCMP";
break; break;
default: default:
return -1; goto out;
} }
strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN); strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
@@ -2031,6 +2031,7 @@ static int rtw_wx_set_enc_ext(struct net_device *dev,
ret = wpa_set_encryption(dev, param, param_len); ret = wpa_set_encryption(dev, param, param_len);
out:
kfree(param); kfree(param);
return ret; return ret;
} }