Patchwork rndis_wlan: Fix potential memory leak in update_pmkid()

login
register
mail settings
Submitter Alexey Khoroshilov
Date Aug. 8, 2012, 3:44 p.m.
Message ID <1344440661-32322-1-git-send-email-khoroshilov@ispras.ru>
Download mbox | patch
Permalink /patch/175941/
State Not Applicable
Delegated to: David Miller
Headers show

Comments

Alexey Khoroshilov - Aug. 8, 2012, 3:44 p.m.
Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 drivers/net/wireless/rndis_wlan.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
Jussi Kivilinna - Aug. 8, 2012, 7:23 p.m.
Quoting Alexey Khoroshilov <khoroshilov@ispras.ru>:

> Do not leak memory by updating pointer with potentially NULL realloc  
> return value.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>

Thanks!

Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>

> ---
>  drivers/net/wireless/rndis_wlan.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/rndis_wlan.c  
> b/drivers/net/wireless/rndis_wlan.c
> index 241162e..7a4ae9e 100644
> --- a/drivers/net/wireless/rndis_wlan.c
> +++ b/drivers/net/wireless/rndis_wlan.c
> @@ -1803,6 +1803,7 @@ static struct ndis_80211_pmkid  
> *update_pmkid(struct usbnet *usbdev,
>  						struct cfg80211_pmksa *pmksa,
>  						int max_pmkids)
>  {
> +	struct ndis_80211_pmkid *new_pmkids;
>  	int i, err, newlen;
>  	unsigned int count;
>
> @@ -1833,11 +1834,12 @@ static struct ndis_80211_pmkid  
> *update_pmkid(struct usbnet *usbdev,
>  	/* add new pmkid */
>  	newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
>
> -	pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
> -	if (!pmkids) {
> +	new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
> +	if (!new_pmkids) {
>  		err = -ENOMEM;
>  		goto error;
>  	}
> +	pmkids = new_pmkids;
>
>  	pmkids->length = cpu_to_le32(newlen);
>  	pmkids->bssid_info_count = cpu_to_le32(count + 1);
> --
> 1.7.9.5
>
>
>



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 241162e..7a4ae9e 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -1803,6 +1803,7 @@  static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
 						struct cfg80211_pmksa *pmksa,
 						int max_pmkids)
 {
+	struct ndis_80211_pmkid *new_pmkids;
 	int i, err, newlen;
 	unsigned int count;
 
@@ -1833,11 +1834,12 @@  static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
 	/* add new pmkid */
 	newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);
 
-	pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
-	if (!pmkids) {
+	new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
+	if (!new_pmkids) {
 		err = -ENOMEM;
 		goto error;
 	}
+	pmkids = new_pmkids;
 
 	pmkids->length = cpu_to_le32(newlen);
 	pmkids->bssid_info_count = cpu_to_le32(count + 1);