Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0ede1a98 authored by Arend van Spriel's avatar Arend van Spriel Committed by Greg Kroah-Hartman
Browse files

wifi: cfg80211: fix memory leak in query_regdb_file() 



[ Upstream commit 57b962e627ec0ae53d4d16d7bd1033e27e67677a ]

In the function query_regdb_file() the alpha2 parameter is duplicated
using kmemdup() and subsequently freed in regdb_fw_cb(). However,
request_firmware_nowait() can fail without calling regdb_fw_cb() and
thus leak memory.

Fixes: 007f6c5e ("cfg80211: support loading regulatory database as firmware file")
Signed-off-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 1c8d0663

net/wireless/reg.c

+9 −3
Original line number Diff line number Diff line
@@ -1060,6 +1060,8 @@ static void regdb_fw_cb(const struct firmware *fw, void *context) 


static int query_regdb_file(const char *alpha2)

{

	int err;



	ASSERT_RTNL();



	if (regdb)
@@ -1069,9 +1071,13 @@ static int query_regdb_file(const char *alpha2) 
	if (!alpha2)

		return -ENOMEM;



	return request_firmware_nowait(THIS_MODULE, true, "regulatory.db",

	err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db",

				      &reg_pdev->dev, GFP_KERNEL,

				      (void *)alpha2, regdb_fw_cb);

	if (err)

		kfree(alpha2);



	return err;

}



int reg_reload_regdb(void)