Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 415ad1ef authored by David Kilroy's avatar David Kilroy Committed by John W. Linville
Browse files

cfg80211: fix leaks of wdev->conn->ie 



This only occurs in the following error situations:
 - driver calls connect_result with failure
 - error scheduling authentication on connect
 - error initiating scan (to get BSSID and channel) on
   connect
 - userspace calls disconnect while in the SCANNING or
   SCAN_AGAIN states

Signed-off-by: default avatarDavid Kilroy <kilroyd@googlemail.com>
Reviewed-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent eeef4185

net/wireless/sme.c

+4 −0
Original line number Diff line number Diff line
@@ -395,6 +395,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid, 


	if (status != WLAN_STATUS_SUCCESS) {

		wdev->sme_state = CFG80211_SME_IDLE;

		if (wdev->conn)

			kfree(wdev->conn->ie);

		kfree(wdev->conn);

		wdev->conn = NULL;

		kfree(wdev->connect_keys);
@@ -779,6 +781,7 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev, 
			}

		}

		if (err) {

			kfree(wdev->conn->ie);

			kfree(wdev->conn);

			wdev->conn = NULL;

			wdev->sme_state = CFG80211_SME_IDLE;
@@ -848,6 +851,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev, 
		    (wdev->conn->state == CFG80211_CONN_SCANNING ||

		     wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {

			wdev->sme_state = CFG80211_SME_IDLE;

			kfree(wdev->conn->ie);

			kfree(wdev->conn);

			wdev->conn = NULL;

			wdev->ssid_len = 0;