diff options
| author |   Arend van Spriel <arend.vanspriel@broadcom.com> | 2022-10-20 13:40:40 +0200 |
|---|---|---|
| committer |   Johannes Berg <johannes.berg@intel.com> | 2022-10-21 12:35:57 +0200 |
| commit | 57b962e627ec0ae53d4d16d7bd1033e27e67677a (patch) | |
| tree | d0ea4f6ea13b07adb51ee51419bef9420465afdc /net | |
| parent | wifi: mac80211: fix memory free error when registering wiphy fail (diff) | |
| download | linux-dev-57b962e627ec0ae53d4d16d7bd1033e27e67677a.tar.xz linux-dev-57b962e627ec0ae53d4d16d7bd1033e27e67677a.zip | |
wifi: cfg80211: fix memory leak in query_regdb_file()
In the function query_regdb_file() the alpha2 parameter is duplicated
using kmemdup() and subsequently freed in regdb_fw_cb(). However,
request_firmware_nowait() can fail without calling regdb_fw_cb() and
thus leak memory.
Fixes: 007f6c5e6eb4 ("cfg80211: support loading regulatory database as firmware file")
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/reg.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/net/wireless/reg.c b/net/wireless/reg.c index d5c7a5aa6853..c3d950d29432 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -1084,6 +1084,8 @@ MODULE_FIRMWARE("regulatory.db"); static int query_regdb_file(const char *alpha2) { + int err; + ASSERT_RTNL(); if (regdb) @@ -1093,9 +1095,13 @@ static int query_regdb_file(const char *alpha2) if (!alpha2) return -ENOMEM; - return request_firmware_nowait(THIS_MODULE, true, "regulatory.db", - ®_pdev->dev, GFP_KERNEL, - (void *)alpha2, regdb_fw_cb); + err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db", + ®_pdev->dev, GFP_KERNEL, + (void *)alpha2, regdb_fw_cb); + if (err) + kfree(alpha2); + + return err; } int reg_reload_regdb(void) |