Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f123c30 authored by Jiasheng Jiang's avatar Jiasheng Jiang Committed by Greg Kroah-Hartman
Browse files

nl80211: Handle nla_memdup failures in handle_nan_filter 



[ Upstream commit 6ad27f522cb3b210476daf63ce6ddb6568c0508b ]

As there's potential for failure of the nla_memdup(),
check the return value.

Fixes: a442b761 ("cfg80211: add add_nan_func / del_nan_func")
Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20220301100020.3801187-1-jiasheng@iscas.ac.cn


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ec89b276

net/wireless/nl80211.c

+12 −0
Original line number Original line Diff line number Diff line
@@ -12320,6 +12320,9 @@ static int handle_nan_filter(struct nlattr *attr_filter, 
	i = 0;

	i = 0;

	nla_for_each_nested(attr, attr_filter, rem) {

	nla_for_each_nested(attr, attr_filter, rem) {

		filter[i].filter = nla_memdup(attr, GFP_KERNEL);

		filter[i].filter = nla_memdup(attr, GFP_KERNEL);

		if (!filter[i].filter)

			goto err;



		filter[i].len = nla_len(attr);

		filter[i].len = nla_len(attr);

		i++;

		i++;

	}

	}
@@ -12332,6 +12335,15 @@ static int handle_nan_filter(struct nlattr *attr_filter, 
	}

	}





	return 0;

	return 0;



err:

	i = 0;

	nla_for_each_nested(attr, attr_filter, rem) {

		kfree(filter[i].filter);

		i++;

	}

	kfree(filter);

	return -ENOMEM;

}

}





static int nl80211_nan_add_func(struct sk_buff *skb,

static int nl80211_nan_add_func(struct sk_buff *skb,