Re: [PATCH] fix error handling in drivers/staging/rtl8192u/ieee80211/ieee80211_module.c

[Kees Cook]

On Wed, Sep 26, 2018 at 10:52 AM,  <valdis.kletnieks@xxxxxx> wrote:
> John notes that if the kzalloc of ieee->pHTInfo fails, we fail to call
> ieee80211_networks_free().  In addition, that function has an un-needed check
> before kfree().
>
> Reported-by: John Whitmore <arigead@xxxxxxxxx>
> Signed-off-by: Valdis Kletnieks <valdis.kletnieks@xxxxxx>

Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>

(And this seems to be the only case of this -- I don't see this code
trivially copy/pasted in other 80211 stacks.)

-Kees


> ---
> diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> index 90a097f2cd4e..97ff0371b5bb 100644
> --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> @@ -78,8 +78,6 @@ static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
>
>  static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
>  {
> -       if (!ieee->networks)
> -               return;
>         kfree(ieee->networks);
>         ieee->networks = NULL;
>  }
> @@ -180,6 +178,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
>         return dev;
>
>   failed:
> +       ieee80211_networks_free(ieee);
>         if (dev)
>                 free_netdev(dev);
>
>



-- 
Kees Cook
Pixel Security