| Message ID | 1417139239-32602-1-git-send-email-LinoSanfilippo@gmx.de |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
On Friday, November 28, 2014 02:47:19 AM Lino Sanfilippo wrote: > Fix missing memory deallocation on error paths in wil_write_file_wmi() > and wil_write_file_txmgmt(). > > Reported-by: Ahmed Tamrawi <ahmedtamrawi@gmail.com> > Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de> > --- > drivers/net/wireless/ath/wil6210/debugfs.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c > index 54a6ddc..4e6e145 100644 > --- a/drivers/net/wireless/ath/wil6210/debugfs.c > +++ b/drivers/net/wireless/ath/wil6210/debugfs.c > @@ -573,8 +573,10 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf, > if (!frame) > return -ENOMEM; > > - if (copy_from_user(frame, buf, len)) > + if (copy_from_user(frame, buf, len)) { > + kfree(frame); > return -EIO; > + } > > params.buf = frame; > params.len = len; > @@ -614,8 +616,10 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, > return -ENOMEM; > > rc = simple_write_to_buffer(wmi, len, ppos, buf, len); > - if (rc < 0) > + if (rc < 0) { > + kfree(wmi); > return rc; > + } > > cmd = &wmi[1]; > cmdid = le16_to_cpu(wmi->id); > Lino and Ahmed: thanks for that. Here is my Signed-off-by: Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com> John: please merge -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c index 54a6ddc..4e6e145 100644 --- a/drivers/net/wireless/ath/wil6210/debugfs.c +++ b/drivers/net/wireless/ath/wil6210/debugfs.c @@ -573,8 +573,10 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf, if (!frame) return -ENOMEM; - if (copy_from_user(frame, buf, len)) + if (copy_from_user(frame, buf, len)) { + kfree(frame); return -EIO; + } params.buf = frame; params.len = len; @@ -614,8 +616,10 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, return -ENOMEM; rc = simple_write_to_buffer(wmi, len, ppos, buf, len); - if (rc < 0) + if (rc < 0) { + kfree(wmi); return rc; + } cmd = &wmi[1]; cmdid = le16_to_cpu(wmi->id);
Fix missing memory deallocation on error paths in wil_write_file_wmi() and wil_write_file_txmgmt(). Reported-by: Ahmed Tamrawi <ahmedtamrawi@gmail.com> Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de> --- drivers/net/wireless/ath/wil6210/debugfs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)