mwifiex: fix possible memory leak in mwifiex_cfg80211_start_ap()
authorWei Yongjun <yongjun_wei@trendmicro.com.cn>
Tue, 12 Jul 2016 11:43:18 +0000 (11:43 +0000)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 18 Jul 2016 19:39:42 +0000 (22:39 +0300)
memory is malloced in mwifiex_cfg80211_start_ap() and should be
freed before leaving from the error handling cases, otherwise it
will cause memory leak.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/cfg80211.c

index 867ab815e16af4496fec29263084693531d7c2fc..a8ff969c95c240295b55017c66b304282804f536 100644 (file)
@@ -1936,10 +1936,9 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
        mwifiex_set_uap_rates(bss_cfg, params);
 
        if (mwifiex_set_secure_params(priv, bss_cfg, params)) {
-               kfree(bss_cfg);
                mwifiex_dbg(priv->adapter, ERROR,
                            "Failed to parse secuirty parameters!\n");
-               return -1;
+               goto out;
        }
 
        mwifiex_set_ht_params(priv, bss_cfg, params);
@@ -1968,7 +1967,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                if (mwifiex_11h_activate(priv, false)) {
                        mwifiex_dbg(priv->adapter, ERROR,
                                    "Failed to disable 11h extensions!!");
-                       return -1;
+                       goto out;
                }
                priv->state_11h.is_11h_active = false;
        }
@@ -1976,12 +1975,11 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
        if (mwifiex_config_start_uap(priv, bss_cfg)) {
                mwifiex_dbg(priv->adapter, ERROR,
                            "Failed to start AP\n");
-               kfree(bss_cfg);
-               return -1;
+               goto out;
        }
 
        if (mwifiex_set_mgmt_ies(priv, &params->beacon))
-               return -1;
+               goto out;
 
        if (!netif_carrier_ok(priv->netdev))
                netif_carrier_on(priv->netdev);
@@ -1990,6 +1988,10 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
        memcpy(&priv->bss_cfg, bss_cfg, sizeof(priv->bss_cfg));
        kfree(bss_cfg);
        return 0;
+
+out:
+       kfree(bss_cfg);
+       return -1;
 }
 
 /*