evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

staging: rtl8188eu: fix potential leak in rtw_mp_SetRFPath()

Browse source 
Function rtw_mp_SetRFPath() dynamically allocates a temporary buffer that
is not freed in all error paths. Use a centralized exit path and make sure
that all memory is freed correctly. Detected by Coverity - CID 1077714.

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Christian Engelmayer 2014-05-07 21:33:20 +02:00 • committed by Greg Kroah-Hartman
parent 3dad0d1e40
commit c98acd000b
1 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
View file

@ -7321,11 +7321,14 @@ static int rtw_mp_SetRFPath(struct net_device *dev,
struct adapter *padapter = rtw_netdev_priv(dev); struct adapter *padapter = rtw_netdev_priv(dev);
char *input = kmalloc(wrqu->data.length, GFP_KERNEL); char *input = kmalloc(wrqu->data.length, GFP_KERNEL);
u8 bMain = 1, bTurnoff = 1; u8 bMain = 1, bTurnoff = 1;
int ret = 0;
if (!input) if (!input)
return -ENOMEM; return -ENOMEM;
if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) {
return -EFAULT; ret = -EFAULT;
goto exit;
}
DBG_88E("%s:iwpriv in =%s\n", __func__, input); DBG_88E("%s:iwpriv in =%s\n", __func__, input);
bMain = strncmp(input, "1", 2); /* strncmp true is 0 */ bMain = strncmp(input, "1", 2); /* strncmp true is 0 */
@ -7338,8 +7341,10 @@ static int rtw_mp_SetRFPath(struct net_device *dev,
MP_PHY_SetRFPathSwitch(padapter, false); MP_PHY_SetRFPathSwitch(padapter, false);
DBG_88E("%s:PHY_SetRFPathSwitch = false\n", __func__); DBG_88E("%s:PHY_SetRFPathSwitch = false\n", __func__);
} }
exit:
kfree(input); kfree(input);
return 0; return ret;
} }
static int rtw_mp_QueryDrv(struct net_device *dev, static int rtw_mp_QueryDrv(struct net_device *dev,