staging: rtl8188eu: fix potential leak in rtw_set_key()

PATCH In review Christian Engelmayer 3 participants 3 messages May 1, 2014 – May 4, 2014 Staging

Share & tools

Christian Engelmayer

author

2014-05-01 10:32 UTC #0 lore raw

PATCH v2 1/1 staging: rtl8188eu: fix potential leak in rtw_set_key()

Fix a potential leak in the error path of rtw_set_key(). In case the requested algorithm is not supported by the driver, the function returns without enqueuing or freeing the already allocated command and parameter structs. Use a centralized exit path and make sure that all memory is freed correctly. Detected by Coverity - CID 1077716, 1077717.

Signed-off-by Christian Engelmayer <[email protected]>

---
v2: Added changes requested by Dan Carpenter:

* Just return directly where no cleanup is needed.
* Prefer naming labels by the labeled action rather than the goto location.

Compile tested and applies against branch staging-next of tree git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git

---
 drivers/staging/rtl8188eu/core/rtw_mlme.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

drivers/staging/rtl8188eu/core/rtw_mlme.c +11 -8

index 769d4dd..155282e 100644
@@ -1727,15 +1727,13 @@ int rtw_set_key(struct adapter *adapter, struct security_priv *psecuritypriv, in
 	int	res = _SUCCESS;
 
 	pcmd = (struct	cmd_obj *)rtw_zmalloc(sizeof(struct	cmd_obj));
-	if (pcmd == NULL) {
-		res = _FAIL;  /* try again */
-		goto exit;
-	}
+	if (pcmd == NULL)
+		return _FAIL;  /* try again */
+
 	psetkeyparm = (struct setkey_parm *)rtw_zmalloc(sizeof(struct setkey_parm));
 	if (psetkeyparm == NULL) {
-		kfree(pcmd);
 		res = _FAIL;
-		goto exit;
+		goto err_free_cmd;
 	}
 
 	_rtw_memset(psetkeyparm, 0, sizeof(struct setkey_parm));

@@ -1784,7 +1782,7 @@ int rtw_set_key(struct adapter *adapter, struct security_priv *psecuritypriv, in
 			 ("\n rtw_set_key:psecuritypriv->dot11PrivacyAlgrthm=%x (must be 1 or 2 or 4 or 5)\n",
 			 psecuritypriv->dot11PrivacyAlgrthm));
 		res = _FAIL;
-		goto exit;
+		goto err_free_parm;
 	}
 	pcmd->cmdcode = _SetKey_CMD_;
 	pcmd->parmbuf = (u8 *)psetkeyparm;

@@ -1793,7 +1791,12 @@ int rtw_set_key(struct adapter *adapter, struct security_priv *psecuritypriv, in
 	pcmd->rspsz = 0;
 	_rtw_init_listhead(&pcmd->list);
 	res = rtw_enqueue_cmd(pcmdpriv, pcmd);
-exit:
+	return res;
+
+err_free_parm:
+	kfree(psetkeyparm);
+err_free_cmd:
+	kfree(pcmd);
 	return res;
 }

Signature · 1 line

1.9.1

Dan Carpenter

Reviewed-by on v2 1/1

2014-05-01 10:50 UTC #1 lore raw

Quoted 7 lines · Christian Engelmayer

Fix a potential leak in the error path of rtw_set_key(). In case the requested algorithm is not supported by the driver, the function returns without enqueuing or freeing the already allocated command and parameter structs. Use a centralized exit path and make sure that all memory is freed correctly. Detected by Coverity - CID 1077716, 1077717.
Signed-off-by Christian Engelmayer <[email protected]>

Quoted 8 lines

---
v2: Added changes requested by Dan Carpenter:
* Just return directly where no cleanup is needed.
* Prefer naming labels by the labeled action rather than the goto location.
Compile tested and applies against branch staging-next of tree git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git

Looks good.

Reviewed-by Dan Carpenter <[email protected]>

regards,
dan carpenter

Greg KH

maintainer

2014-05-04 01:13 UTC #2 lore raw

In reply to Christian Engelmayer

Quoted 8 lines · Christian Engelmayer

Fix a potential leak in the error path of rtw_set_key(). In case the requested algorithm is not supported by the driver, the function returns without enqueuing or freeing the already allocated command and parameter structs. Use a centralized exit path and make sure that all memory is freed correctly. Detected by Coverity - CID 1077716, 1077717.
Signed-off-by Christian Engelmayer <[email protected]>
Reviewed-by Dan Carpenter <[email protected]>

Quoted 8 lines

---
v2: Added changes requested by Dan Carpenter:
* Just return directly where no cleanup is needed.
* Prefer naming labels by the labeled action rather than the goto location.
Compile tested and applies against branch staging-next of tree git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git

This patch doesn't apply to my tree, can you refresh and resend it?

thanks,

greg k-h