Commit 1d8e898a authored by YueHaibing's avatar YueHaibing Committed by Greg Kroah-Hartman

mwifiex: Fix mem leak in mwifiex_tm_cmd

[ Upstream commit 003b686a ]

'hostcmd' is alloced by kzalloc, should be freed before
leaving from the error handling cases, otherwise it will
cause mem leak.

Fixes: 3935ccc1 ("mwifiex: add cfg80211 testmode support")
Signed-off-by: default avatarYueHaibing <yuehaibing@huawei.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 8dc032a2
...@@ -4082,16 +4082,20 @@ static int mwifiex_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev, ...@@ -4082,16 +4082,20 @@ static int mwifiex_tm_cmd(struct wiphy *wiphy, struct wireless_dev *wdev,
if (mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, true)) { if (mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, true)) {
dev_err(priv->adapter->dev, "Failed to process hostcmd\n"); dev_err(priv->adapter->dev, "Failed to process hostcmd\n");
kfree(hostcmd);
return -EFAULT; return -EFAULT;
} }
/* process hostcmd response*/ /* process hostcmd response*/
skb = cfg80211_testmode_alloc_reply_skb(wiphy, hostcmd->len); skb = cfg80211_testmode_alloc_reply_skb(wiphy, hostcmd->len);
if (!skb) if (!skb) {
kfree(hostcmd);
return -ENOMEM; return -ENOMEM;
}
err = nla_put(skb, MWIFIEX_TM_ATTR_DATA, err = nla_put(skb, MWIFIEX_TM_ATTR_DATA,
hostcmd->len, hostcmd->cmd); hostcmd->len, hostcmd->cmd);
if (err) { if (err) {
kfree(hostcmd);
kfree_skb(skb); kfree_skb(skb);
return -EMSGSIZE; return -EMSGSIZE;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment