* [PATCH 0/7] iw: various bug fixes
@ 2019-05-17 19:29 John Crispin
2019-05-17 19:29 ` [PATCH 1/7] iw: fix memory leak inside register_mgmt_frame John Crispin
` (6 more replies)
0 siblings, 7 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
These fixes were extracted from the latest Intel/UGW. I am assuming they
ran static code analyses/Klocwork in the source.
John Crispin (7):
iw: fix memory leak inside register_mgmt_frame
iw: fix endless loop inside handle_mgmt_dump
iw: fix memory leak inside handle_cac
iw: fix fd leak inside handle_netns
iw: fix memory leak inside parse_sched_scan
iw: fix memory leaks inside handle_scan
iw: fix fp handling inside handle_vendor
mgmt.c | 4 ++++
phy.c | 25 ++++++++++++++++++-------
scan.c | 34 +++++++++++++++++-----------------
vendor.c | 5 ++++-
4 files changed, 43 insertions(+), 25 deletions(-)
--
2.20.1
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH 1/7] iw: fix memory leak inside register_mgmt_frame
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
@ 2019-05-17 19:29 ` John Crispin
2019-05-17 19:29 ` [PATCH 2/7] iw: fix endless loop inside handle_mgmt_dump John Crispin
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
Signed-off-by: John Crispin <john@phrozen.org>
---
mgmt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mgmt.c b/mgmt.c
index 60f544b..88fe3fd 100644
--- a/mgmt.c
+++ b/mgmt.c
@@ -69,9 +69,11 @@ static int register_mgmt_frame(struct nl80211_state *state,
NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
+ free(match);
return 0;
nla_put_failure:
+ free(match);
return -ENOBUFS;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 2/7] iw: fix endless loop inside handle_mgmt_dump
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
2019-05-17 19:29 ` [PATCH 1/7] iw: fix memory leak inside register_mgmt_frame John Crispin
@ 2019-05-17 19:29 ` John Crispin
2019-05-17 19:29 ` [PATCH 3/7] iw: fix memory leak inside handle_cac John Crispin
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
passing -1 will break the while loop further down in the code.
Signed-off-by: John Crispin <john@phrozen.org>
---
mgmt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mgmt.c b/mgmt.c
index 88fe3fd..338435d 100644
--- a/mgmt.c
+++ b/mgmt.c
@@ -109,6 +109,8 @@ static int handle_mgmt_dump(struct nl80211_state *state,
for (i = 3; i < argc; i += 3) {
if (strcmp(argv[i], "count") == 0) {
count = 1 + atoi(argv[i + 1]);
+ if (count < 1)
+ count = 1;
break;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 3/7] iw: fix memory leak inside handle_cac
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
2019-05-17 19:29 ` [PATCH 1/7] iw: fix memory leak inside register_mgmt_frame John Crispin
2019-05-17 19:29 ` [PATCH 2/7] iw: fix endless loop inside handle_mgmt_dump John Crispin
@ 2019-05-17 19:29 ` John Crispin
2019-05-17 19:29 ` [PATCH 4/7] iw: fix fd leak inside handle_netns John Crispin
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
Signed-off-by: John Crispin <john@phrozen.org>
---
phy.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/phy.c b/phy.c
index 77df7a7..a4425ea 100644
--- a/phy.c
+++ b/phy.c
@@ -328,12 +328,15 @@ static int handle_cac(struct nl80211_state *state,
} else if (strcmp(argv[2], "freq") == 0) {
err = parse_freqchan(&chandef, false, argc - 3, argv + 3, NULL);
} else {
- return 1;
+ err = 1;
+ goto err_out;
}
cac_trigger_argv = calloc(argc + 1, sizeof(char*));
- if (!cac_trigger_argv)
- return -ENOMEM;
+ if (!cac_trigger_argv) {
+ err = -ENOMEM;
+ goto err_out;
+ }
cac_trigger_argv[0] = argv[0];
cac_trigger_argv[1] = "cac";
@@ -341,9 +344,8 @@ static int handle_cac(struct nl80211_state *state,
memcpy(&cac_trigger_argv[3], &argv[2], (argc - 2) * sizeof(char*));
err = handle_cmd(state, id, argc + 1, cac_trigger_argv);
- free(cac_trigger_argv);
if (err)
- return err;
+ goto err_out;
cac_event.ret = 1;
cac_event.freq = chandef.control_freq;
@@ -357,7 +359,13 @@ static int handle_cac(struct nl80211_state *state,
while (cac_event.ret > 0)
nl_recvmsgs(state->nl_sock, radar_cb);
- return 0;
+ err = 0;
+err_out:
+ if (radar_cb)
+ nl_cb_put(radar_cb);
+ if (cac_trigger_argv)
+ free(cac_trigger_argv);
+ return err;
}
TOPLEVEL(cac, "channel <channel> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
"freq <freq> [NOHT|HT20|HT40+|HT40-|5MHz|10MHz|80MHz]\n"
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 4/7] iw: fix fd leak inside handle_netns
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
` (2 preceding siblings ...)
2019-05-17 19:29 ` [PATCH 3/7] iw: fix memory leak inside handle_cac John Crispin
@ 2019-05-17 19:29 ` John Crispin
2019-05-17 19:29 ` [PATCH 5/7] iw: fix memory leak inside parse_sched_scan John Crispin
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
Signed-off-by: John Crispin <john@phrozen.org>
---
phy.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/phy.c b/phy.c
index a4425ea..ba89d46 100644
--- a/phy.c
+++ b/phy.c
@@ -1,6 +1,7 @@
#include <stdbool.h>
#include <errno.h>
#include <strings.h>
+#include <unistd.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <fcntl.h>
@@ -531,7 +532,7 @@ static int handle_netns(struct nl80211_state *state,
enum id_input id)
{
char *end;
- int fd;
+ int fd = -1;
if (argc < 1 || !*argv[0])
return 1;
@@ -559,6 +560,8 @@ static int handle_netns(struct nl80211_state *state,
return 1;
nla_put_failure:
+ if (fd >= 0)
+ close(fd);
return -ENOBUFS;
}
COMMAND(set, netns, "{ <pid> | name <nsname> }",
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 5/7] iw: fix memory leak inside parse_sched_scan
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
` (3 preceding siblings ...)
2019-05-17 19:29 ` [PATCH 4/7] iw: fix fd leak inside handle_netns John Crispin
@ 2019-05-17 19:29 ` John Crispin
2019-05-17 19:29 ` [PATCH 6/7] iw: fix memory leaks inside handle_scan John Crispin
2019-05-17 19:29 ` [PATCH 7/7] iw: fix fp handling inside handle_vendor John Crispin
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
Signed-off-by: John Crispin <john@phrozen.org>
---
scan.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/scan.c b/scan.c
index b0b7828..980bfb4 100644
--- a/scan.c
+++ b/scan.c
@@ -355,11 +355,12 @@ int parse_sched_scan(struct nl_msg *msg, int *argc, char ***argv)
nla_put_failure:
if (match)
nla_nest_end(msg, match);
+out:
nlmsg_free(freqs);
nlmsg_free(matchset);
nlmsg_free(scan_plans);
+ nlmsg_free(ssids);
-out:
*argc = c;
*argv = v;
return err;
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 6/7] iw: fix memory leaks inside handle_scan
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
` (4 preceding siblings ...)
2019-05-17 19:29 ` [PATCH 5/7] iw: fix memory leak inside parse_sched_scan John Crispin
@ 2019-05-17 19:29 ` John Crispin
2019-05-17 19:29 ` [PATCH 7/7] iw: fix fp handling inside handle_vendor John Crispin
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
Signed-off-by: John Crispin <john@phrozen.org>
---
scan.c | 31 +++++++++++++++----------------
1 file changed, 15 insertions(+), 16 deletions(-)
diff --git a/scan.c b/scan.c
index 980bfb4..6ad3ad4 100644
--- a/scan.c
+++ b/scan.c
@@ -389,7 +389,7 @@ static int handle_scan(struct nl80211_state *state,
bool passive = false, have_ssids = false, have_freqs = false;
bool duration_mandatory = false;
size_t ies_len = 0, meshid_len = 0;
- unsigned char *ies = NULL, *meshid = NULL, *tmpies;
+ unsigned char *ies = NULL, *meshid = NULL, *tmpies = NULL;
unsigned int flags = 0;
ssids = nlmsg_alloc();
@@ -450,7 +450,8 @@ static int handle_scan(struct nl80211_state *state,
case DONE:
nlmsg_free(ssids);
nlmsg_free(freqs);
- return 1;
+ err = 1;
+ goto nla_put_failure;
case FREQ:
freq = strtoul(argv[i], &eptr, 10);
if (eptr != argv[i] + strlen(argv[i])) {
@@ -462,6 +463,8 @@ static int handle_scan(struct nl80211_state *state,
NLA_PUT_U32(freqs, i, freq);
break;
case IES:
+ if (ies)
+ free(ies);
ies = parse_hex(argv[i], &ies_len);
if (!ies)
goto nla_put_failure;
@@ -490,24 +493,14 @@ static int handle_scan(struct nl80211_state *state,
if (ies || meshid) {
tmpies = (unsigned char *) malloc(ies_len + meshid_len);
- if (!tmpies) {
- free(ies);
- free(meshid);
+ if (!tmpies)
goto nla_put_failure;
- }
- if (ies) {
+ if (ies)
memcpy(tmpies, ies, ies_len);
- free(ies);
- }
- if (meshid) {
+ if (meshid)
memcpy(&tmpies[ies_len], meshid, meshid_len);
- free(meshid);
- }
- if (nla_put(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies) < 0) {
- free(tmpies);
+ if (nla_put(msg, NL80211_ATTR_IE, ies_len + meshid_len, tmpies) < 0)
goto nla_put_failure;
- }
- free(tmpies);
}
if (!have_ssids)
@@ -535,6 +528,12 @@ static int handle_scan(struct nl80211_state *state,
nla_put_failure:
nlmsg_free(ssids);
nlmsg_free(freqs);
+ if (meshid)
+ free(meshid);
+ if (ies)
+ free(ies);
+ if (tmpies)
+ free(tmpies);
return err;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH 7/7] iw: fix fp handling inside handle_vendor
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
` (5 preceding siblings ...)
2019-05-17 19:29 ` [PATCH 6/7] iw: fix memory leaks inside handle_scan John Crispin
@ 2019-05-17 19:29 ` John Crispin
6 siblings, 0 replies; 8+ messages in thread
From: John Crispin @ 2019-05-17 19:29 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, John Crispin
The fp can leak and should not be closed if we do i/o redirection.
Signed-off-by: John Crispin <john@phrozen.org>
---
vendor.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/vendor.c b/vendor.c
index 860cd48..d203d85 100644
--- a/vendor.c
+++ b/vendor.c
@@ -107,7 +107,8 @@ static int handle_vendor(struct nl80211_state *state,
if (file) {
count = read_file(file, buf, sizeof(buf));
- fclose(file);
+ if (file != stdin)
+ fclose(file);
} else
count = read_hex(argc - 2, &argv[2], buf, sizeof(buf));
@@ -120,6 +121,8 @@ static int handle_vendor(struct nl80211_state *state,
return 0;
nla_put_failure:
+ if (file && file != stdin)
+ fclose(file);
return -ENOBUFS;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2019-05-17 19:30 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-17 19:29 [PATCH 0/7] iw: various bug fixes John Crispin
2019-05-17 19:29 ` [PATCH 1/7] iw: fix memory leak inside register_mgmt_frame John Crispin
2019-05-17 19:29 ` [PATCH 2/7] iw: fix endless loop inside handle_mgmt_dump John Crispin
2019-05-17 19:29 ` [PATCH 3/7] iw: fix memory leak inside handle_cac John Crispin
2019-05-17 19:29 ` [PATCH 4/7] iw: fix fd leak inside handle_netns John Crispin
2019-05-17 19:29 ` [PATCH 5/7] iw: fix memory leak inside parse_sched_scan John Crispin
2019-05-17 19:29 ` [PATCH 6/7] iw: fix memory leaks inside handle_scan John Crispin
2019-05-17 19:29 ` [PATCH 7/7] iw: fix fp handling inside handle_vendor John Crispin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).