Skip to contentSkip to conversation

nl80211: fix error pointer dereference in error handling

PATCH In review Dan Carpenter 2 participants 2 messages Oct 1, 2021

Subsystems (2)
Kernel janitors 802.11 (including cfg80211/NL80211)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 nl80211: fix error pointer dereference in error handling

The error handling calls kfree(params->acl) so if "params->acl" is an error pointer that will lead to an Oops.

Fixes 9e263e193af7 ("nl80211: don't put struct cfg80211_ap_settings on stack")
Signed-off-by Dan Carpenter <[email protected]>
---
 net/wireless/nl80211.c | 1 +
 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
index 0b4f29d689d2..962fb169a5fb 100644
@@ -5507,6 +5507,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
 		params->acl = parse_acl_data(&rdev->wiphy, info);
 		if (IS_ERR(params->acl)) {
 			err = PTR_ERR(params->acl);
+			params->acl = NULL;
 			goto out;
 		}
 	}
Signature · 1 line
2.20.1
maintainer
#1 lore raw
Quoted 14 lines · Dan Carpenter

The error handling calls kfree(params->acl) so if "params->acl" is an error pointer that will lead to an Oops.

Fixes 9e263e193af7 ("nl80211: don't put struct cfg80211_ap_settings on stack")
Signed-off-by Dan Carpenter <[email protected]>

---
 net/wireless/nl80211.c | 1 +

 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +0 -0
index 0b4f29d689d2..962fb169a5fb 100644

net/wireless/nl80211.c static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) · line 5510

Quoted 4 lines
net/wireless/nl80211.c +1 -0
@@ -5507,6 +5507,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
  		params->acl = parse_acl_data(&rdev->wiphy, info);
  		if (IS_ERR(params->acl)) {
  			err = PTR_ERR(params->acl);
+			params->acl = NULL;

Yeah. I think I had just applied the exact same patch:

commit 05075fe7455a210769b266e62a0040ddc98b2739

Author: Johannes Berg <[email protected]>
Date:   Mon Sep 27 13:44:03 2021 +0200
    nl80211: don't kfree() ERR_PTR() value

johannes