Skip to content

Commit

Permalink
rndis_wlan: Fix potential memory leak in update_pmkid()
Browse files Browse the repository at this point in the history
Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Alexey Khoroshilov authored and John W. Linville committed Aug 10, 2012
1 parent f41a9b3 commit 60f53cf
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions drivers/net/wireless/rndis_wlan.c
Original file line number Diff line number Diff line change
Expand Up @@ -1803,6 +1803,7 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
struct cfg80211_pmksa *pmksa,
int max_pmkids)
{
struct ndis_80211_pmkid *new_pmkids;
int i, err, newlen;
unsigned int count;

Expand Down Expand Up @@ -1833,11 +1834,12 @@ static struct ndis_80211_pmkid *update_pmkid(struct usbnet *usbdev,
/* add new pmkid */
newlen = sizeof(*pmkids) + (count + 1) * sizeof(pmkids->bssid_info[0]);

pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
if (!pmkids) {
new_pmkids = krealloc(pmkids, newlen, GFP_KERNEL);
if (!new_pmkids) {
err = -ENOMEM;
goto error;
}
pmkids = new_pmkids;

pmkids->length = cpu_to_le32(newlen);
pmkids->bssid_info_count = cpu_to_le32(count + 1);
Expand Down

0 comments on commit 60f53cf

Please sign in to comment.