diff options
| author | Martin Kaiser <martin@kaiser.cx> | 2021-10-19 23:23:56 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-11-12 17:05:51 +0300 |
| commit | 4787caef521c462d3eccc8dc7d2cbefc58522fdb (patch) | |
| tree | e122c90a249838f05d43621fb6379a259dbb339c /drivers/staging | |
| parent | 8f60f9f6ee2498c6abd2d422f9a44f6d12d5cecd (diff) | |
| download | linux-4787caef521c462d3eccc8dc7d2cbefc58522fdb.tar.xz | |
staging: r8188eu: fix memleak in rtw_wx_set_enc_ext
commit 26f448371820cf733c827c11f0c77ce304a29b51 upstream.
Free the param struct if the caller sets an unsupported algorithm
and we return an error.
Fixes: 2b42bd58b321 ("staging: r8188eu: introduce new os_dep dir for RTL8188eu driver")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Link: https://lore.kernel.org/r/20211019202356.12572-1-martin@kaiser.cx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/r8188eu/os_dep/ioctl_linux.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c index 1fd375076001..013c322b98a2 100644 --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -1978,7 +1978,7 @@ static int rtw_wx_set_enc_ext(struct net_device *dev, struct ieee_param *param = NULL; struct iw_point *pencoding = &wrqu->encoding; struct iw_encode_ext *pext = (struct iw_encode_ext *)extra; - int ret = 0; + int ret = -1; param_len = sizeof(struct ieee_param) + pext->key_len; param = kzalloc(param_len, GFP_KERNEL); @@ -2004,7 +2004,7 @@ static int rtw_wx_set_enc_ext(struct net_device *dev, alg_name = "CCMP"; break; default: - return -1; + goto out; } strncpy((char *)param->u.crypt.alg, alg_name, IEEE_CRYPT_ALG_NAME_LEN); @@ -2031,6 +2031,7 @@ static int rtw_wx_set_enc_ext(struct net_device *dev, ret = wpa_set_encryption(dev, param, param_len); +out: kfree(param); return ret; } |