diff options
| author | Wei Yongjun <yongjun_wei@trendmicro.com.cn> | 2012-09-02 21:41:04 +0800 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2012-09-04 18:06:00 +0200 |
| commit | b4e4f47e940bc93c5b1125a4429ff53956754800 (patch) | |
| tree | b7cfe228d939d69b217c4b632abf57184e7a894f /net | |
| parent | 3d2abdfdf14f4d6decc2023708211e19b096f4ca (diff) | |
| download | op-kernel-dev-b4e4f47e940bc93c5b1125a4429ff53956754800.zip op-kernel-dev-b4e4f47e940bc93c5b1125a4429ff53956754800.tar.gz | |
nl80211: fix possible memory leak nl80211_connect()
connkeys is malloced in nl80211_parse_connkeys() and should
be freed in the error handling case, otherwise it will cause
memory leak.
spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/nl80211.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 97026f3..1e37dbf 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -5633,8 +5633,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) sizeof(connect.ht_capa_mask)); if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { - if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) + if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { + kfree(connkeys); return -EINVAL; + } memcpy(&connect.ht_capa, nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), sizeof(connect.ht_capa)); |
