nl80211: Fix potential memory leak in nl80211_connect
authorOla Olsson <ola1olsson@gmail.com>
Fri, 11 Dec 2015 20:04:52 +0000 (21:04 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 15 Dec 2015 12:11:26 +0000 (13:11 +0100)
Free cached keys if the last early return path is taken.

Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/nl80211.c

index 624174f20b1f8b7e264f1e5e715660fd785c4646..75b0d23ee882293a07fb9e236757931780def482 100644 (file)
@@ -7941,8 +7941,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
        if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
                if (!(rdev->wiphy.features &
                      NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
-                   !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
+                   !(rdev->wiphy.features & NL80211_FEATURE_QUIET)) {
+                       kzfree(connkeys);
                        return -EINVAL;
+               }
                connect.flags |= ASSOC_REQ_USE_RRM;
        }