linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Martin Kaiser <martin@kaiser.cx>
Subject: [PATCH 5.15 24/26] staging: r8188eu: fix memleak in rtw_wx_set_enc_ext
Date: Wed, 10 Nov 2021 19:44:23 +0100	[thread overview]
Message-ID: <20211110182004.454072244@linuxfoundation.org> (raw)
In-Reply-To: <20211110182003.700594531@linuxfoundation.org>

From: Martin Kaiser <martin@kaiser.cx>

commit 26f448371820cf733c827c11f0c77ce304a29b51 upstream.

Free the param struct if the caller sets an unsupported algorithm
and we return an error.

Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211019202356.12572-1-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/r8188eu/os_dep/ioctl_linux.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
@@ -1978,7 +1978,7 @@ static int rtw_wx_set_enc_ext(struct net
 	struct ieee_param *param = NULL;
 	struct iw_point *pencoding = &wrqu->encoding;
 	struct iw_encode_ext *pext = (struct iw_encode_ext *)extra;
-	int ret = 0;
+	int ret = -1;
 
 	param_len = sizeof(struct ieee_param) + pext->key_len;
 	param = kzalloc(param_len, GFP_KERNEL);
@@ -2004,7 +2004,7 @@ static int rtw_wx_set_enc_ext(struct net
 		alg_name = "CCMP";
 		break;
 	default:
-		return -1;
+		goto out;
 	}
 
 	strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN);
@@ -2031,6 +2031,7 @@ static int rtw_wx_set_enc_ext(struct net
 
 	ret =  wpa_set_encryption(dev, param, param_len);
 
+out:
 	kfree(param);
 	return ret;
 }



  parent reply	other threads:[~2021-11-10 18:57 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-10 18:43 [PATCH 5.15 00/26] 5.15.2-rc1 review Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 01/26] KVM: x86: avoid warning with -Wbitwise-instead-of-logical Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 02/26] Revert "x86/kvm: fix vcpu-id indexed array sizes" Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 03/26] usb: ehci: handshake CMD_RUN instead of STS_HALT Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 04/26] usb: gadget: Mark USB_FSL_QE broken on 64-bit Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 05/26] usb: musb: Balance list entry in musb_gadget_queue Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 06/26] usb-storage: Add compatibility quirk flags for iODD 2531/2541 Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 07/26] Revert "proc/wchan: use printk format instead of lookup_symbol_name()" Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 08/26] binder: use euid from cred instead of using task Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 09/26] binder: use cred instead of task for selinux checks Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 10/26] binder: use cred instead of task for getsecid Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 11/26] binder: dont detect sender/target during buffer cleanup Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 12/26] kfence: always use static branches to guard kfence_alloc() Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 13/26] kfence: default to dynamic branch instead of static keys mode Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 14/26] btrfs: fix lzo_decompress_bio() kmap leakage Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 15/26] staging: rtl8712: fix use-after-free in rtl8712_dl_fw Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 16/26] isofs: Fix out of bound access for corrupted isofs image Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 17/26] comedi: dt9812: fix DMA buffers on stack Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 18/26] comedi: ni_usb6501: fix NULL-deref in command paths Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 19/26] comedi: vmk80xx: fix transfer-buffer overflows Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 20/26] comedi: vmk80xx: fix bulk-buffer overflow Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 21/26] comedi: vmk80xx: fix bulk and interrupt message timeouts Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 22/26] staging: r8712u: fix control-message timeout Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 23/26] staging: rtl8192u: fix control-message timeouts Greg Kroah-Hartman
2021-11-10 18:44 ` Greg Kroah-Hartman [this message]
2021-11-10 18:44 ` [PATCH 5.15 25/26] media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init Greg Kroah-Hartman
2021-11-10 18:44 ` [PATCH 5.15 26/26] rsi: fix control-message timeout Greg Kroah-Hartman
2021-11-10 23:43 ` [PATCH 5.15 00/26] 5.15.2-rc1 review Florian Fainelli
2021-11-11  9:57 ` Naresh Kamboju
2021-11-11 16:26 ` Shuah Khan
2021-11-11 16:37 ` Fox Chen
2021-11-12  0:59 ` Guenter Roeck
2021-11-12 15:46 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211110182004.454072244@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=martin@kaiser.cx \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).