diff mbox series

mwifiex: Fix mem leak in mwifiex_tm_cmd

Message ID 20190312070358.12700-1-yuehaibing@huawei.com (mailing list archive)
State Accepted
Commit 003b686ace820ce2d635a83f10f2d7f9c147dabc
Delegated to: Kalle Valo
Headers show
Series mwifiex: Fix mem leak in mwifiex_tm_cmd | expand

Commit Message

Yue Haibing March 12, 2019, 7:03 a.m. UTC 
From: YueHaibing <yuehaibing@huawei.com>

'hostcmd' is alloced by kzalloc, should be freed before
leaving from the error handling cases, otherwise it will
cause mem leak.

Fixes: 3935ccc14d2c ("mwifiex: add cfg80211 testmode support")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Kalle Valo April 4, 2019, 10:19 a.m. UTC | #1 
Yue Haibing <yuehaibing@huawei.com> wrote:

> From: YueHaibing <yuehaibing@huawei.com>
> 
> 'hostcmd' is alloced by kzalloc, should be freed before
> leaving from the error handling cases, otherwise it will
> cause mem leak.
> 
> Fixes: 3935ccc14d2c ("mwifiex: add cfg80211 testmode support")
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>

Patch applied to wireless-drivers-next.git, thanks.

003b686ace82 mwifiex: Fix mem leak in mwifiex_tm_cmd
diff mbox series

Patch

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index c46f0a5..e582d9b 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -4082,16 +4082,20 @@  static int mwifiex_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 		if (mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, true)) {
 			dev_err(priv->adapter->dev, "Failed to process hostcmd\n");
+			kfree(hostcmd);
 			return -EFAULT;
 		}
 
 		/* process hostcmd response*/
 		skb = cfg80211_testmode_alloc_reply_skb(wiphy, hostcmd->len);
-		if (!skb)
+		if (!skb) {
+			kfree(hostcmd);
 			return -ENOMEM;
+		}
 		err = nla_put(skb, MWIFIEX_TM_ATTR_DATA,
 			      hostcmd->len, hostcmd->cmd);
 		if (err) {
+			kfree(hostcmd);
 			kfree_skb(skb);
 			return -EMSGSIZE;
 		}