Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17b7e1ba authored by Jesper Juhl's avatar Jesper Juhl Committed by Greg Kroah-Hartman
Browse files

staging: vt6656: Don't leak memory in drivers/staging/vt6656/ioctl.c::private_ioctl() 



If copy_to_user() fails in the WLAN_CMD_GET_NODE_LIST case of the
switch in drivers/staging/vt6656/ioctl.c::private_ioctl() we'll leak
the memory allocated to 'pNodeList'. Fix that by kfree'ing the memory
in the failure case.
Also remove a pointless cast (to type 'PSNodeList') of a kmalloc()
return value - kmalloc() returns a void pointer that is implicitly
converted, so there is no need for an explicit cast.

Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 62d2feb9

drivers/staging/vt6656/ioctl.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -565,7 +565,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) 
			result = -ENOMEM;

			result = -ENOMEM;

			break;

			break;

		}

		}

		pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);

		pNodeList = kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC);

		if (pNodeList == NULL) {

		if (pNodeList == NULL) {

			result = -ENOMEM;

			result = -ENOMEM;

			break;

			break;
@@ -601,6 +601,7 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) 
			}

			}

		}

		}

		if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {

		if (copy_to_user(pReq->data, pNodeList, sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)))) {

			kfree(pNodeList);

			result = -EFAULT;

			result = -EFAULT;

			break;

			break;

		}

		}