| Message ID | 1504cd7d842d13ddb8244e18004523128d5c9523.1636615284.git.christophe.jaillet@wanadoo.fr (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | a571bc28326d9f3e13f5f2d9cda2883e0631b0ce |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | iwlwifi: Fix memory leaks in error handling path | expand |
On Thu, 2021-11-11 at 08:23 +0100, Christophe JAILLET wrote: > Should an error occur (invalid TLV len or memory allocation failure), the > memory already allocated in 'reduce_power_data' should be freed before > returning, otherwise it is leaking. > > Fixes: 9dad325f9d57 ("iwlwifi: support loading the reduced power table from UEFI") > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > --- > drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c > index c875bf35533c..009dd4be597b 100644 > --- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c > +++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c > @@ -86,6 +86,7 @@ static void *iwl_uefi_reduce_power_section(struct iwl_trans *trans, > if (len < tlv_len) { > IWL_ERR(trans, "invalid TLV len: %zd/%u\n", > len, tlv_len); > + kfree(reduce_power_data); > reduce_power_data = ERR_PTR(-EINVAL); > goto out; > } > @@ -105,6 +106,7 @@ static void *iwl_uefi_reduce_power_section(struct iwl_trans *trans, > IWL_DEBUG_FW(trans, > "Couldn't allocate (more) reduce_power_data\n"); > > + kfree(reduce_power_data); > reduce_power_data = ERR_PTR(-ENOMEM); > goto out; > } > @@ -134,6 +136,10 @@ static void *iwl_uefi_reduce_power_section(struct iwl_trans *trans, > done: > if (!size) { > IWL_DEBUG_FW(trans, "Empty REDUCE_POWER, skipping.\n"); > + /* Better safe than sorry, but 'reduce_power_data' should > + * always be NULL if !size. > + */ > + kfree(reduce_power_data); > reduce_power_data = ERR_PTR(-ENOENT); > goto out; > } Looks good, thanks! Kalle, assigning to you for wireless-drivers. -- Cheers, Luca.
Christophe JAILLET <christophe.jaillet@wanadoo.fr> wrote: > Should an error occur (invalid TLV len or memory allocation failure), the > memory already allocated in 'reduce_power_data' should be freed before > returning, otherwise it is leaking. > > Fixes: 9dad325f9d57 ("iwlwifi: support loading the reduced power table from UEFI") > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Patch applied to wireless-drivers.git, thanks. a571bc28326d iwlwifi: Fix memory leaks in error handling path
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c index c875bf35533c..009dd4be597b 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c @@ -86,6 +86,7 @@ static void *iwl_uefi_reduce_power_section(struct iwl_trans *trans, if (len < tlv_len) { IWL_ERR(trans, "invalid TLV len: %zd/%u\n", len, tlv_len); + kfree(reduce_power_data); reduce_power_data = ERR_PTR(-EINVAL); goto out; } @@ -105,6 +106,7 @@ static void *iwl_uefi_reduce_power_section(struct iwl_trans *trans, IWL_DEBUG_FW(trans, "Couldn't allocate (more) reduce_power_data\n"); + kfree(reduce_power_data); reduce_power_data = ERR_PTR(-ENOMEM); goto out; } @@ -134,6 +136,10 @@ static void *iwl_uefi_reduce_power_section(struct iwl_trans *trans, done: if (!size) { IWL_DEBUG_FW(trans, "Empty REDUCE_POWER, skipping.\n"); + /* Better safe than sorry, but 'reduce_power_data' should + * always be NULL if !size. + */ + kfree(reduce_power_data); reduce_power_data = ERR_PTR(-ENOENT); goto out; }
Should an error occur (invalid TLV len or memory allocation failure), the memory already allocated in 'reduce_power_data' should be freed before returning, otherwise it is leaking. Fixes: 9dad325f9d57 ("iwlwifi: support loading the reduced power table from UEFI") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> --- drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 ++++++ 1 file changed, 6 insertions(+)