Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60f53cf9 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by John W. Linville
Browse files

rndis_wlan: Fix potential memory leak in update_pmkid() 



Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: default avatarJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent f41a9b3b

drivers/net/wireless/rndis_wlan.c

+4 −2
Original line number Diff line number Diff line
@@ -1803,6 +1803,7 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev, 
						struct cfg80211_pmksa *pmksa,

						int max_pmkids)

{

	struct ndis_80211_pmkid *new_pmkids;

	int i, err, newlen;

	unsigned int count;
@@ -1833,11 +1834,12 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev, 
	/* add new pmkid */

	newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);



	pmkids = krealloc(pmkids, newlen, GFP_KERNEL);

	if (!pmkids) {

	new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);

	if (!new_pmkids) {

		err = -ENOMEM;

		goto error;

	}

	pmkids = new_pmkids;



	pmkids->length = cpu_to_le32(newlen);

	pmkids->bssid_info_count = cpu_to_le32(count + 1);