diff options
| author | Christian Lamparter <chunkeey@googlemail.com> | 2016-12-29 16:12:09 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2016-12-30 11:11:17 +0200 |
| commit | 097e46d2ae90265d1afe141ba6208ba598b79e01 (patch) | |
| tree | 27d922a1f0f3b2e6058bde58514ea2d304cb4da5 /drivers/net/wireless/ath/ath10k/wmi-tlv.c | |
| parent | 8617690174041dfe959b6ad71f1ff93ef4bea5d3 (diff) | |
| download | blackbird-op-linux-097e46d2ae90265d1afe141ba6208ba598b79e01.tar.gz blackbird-op-linux-097e46d2ae90265d1afe141ba6208ba598b79e01.zip | |
ath10k: fix potential memory leak in ath10k_wmi_tlv_op_pull_fw_stats()
ath10k_wmi_tlv_op_pull_fw_stats() uses tb = ath10k_wmi_tlv_parse_alloc(...)
function, which allocates memory. If any of the three error-paths are
taken, this tb needs to be freed.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath10k/wmi-tlv.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/wmi-tlv.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index f304f6632c4f..1f6bb9e8bb01 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -1105,8 +1105,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar, struct ath10k_fw_stats_pdev *dst; src = data; - if (data_len < sizeof(*src)) + if (data_len < sizeof(*src)) { + kfree(tb); return -EPROTO; + } data += sizeof(*src); data_len -= sizeof(*src); @@ -1126,8 +1128,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar, struct ath10k_fw_stats_vdev *dst; src = data; - if (data_len < sizeof(*src)) + if (data_len < sizeof(*src)) { + kfree(tb); return -EPROTO; + } data += sizeof(*src); data_len -= sizeof(*src); @@ -1145,8 +1149,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar, struct ath10k_fw_stats_peer *dst; src = data; - if (data_len < sizeof(*src)) + if (data_len < sizeof(*src)) { + kfree(tb); return -EPROTO; + } data += sizeof(*src); data_len -= sizeof(*src); |
