From: Dan Carpenter <error27@gmail.com>
To: Johannes Berg <johannes@sipsolutions.net>
Cc: "John W. Linville" <linville@tuxdriver.com>,
"David S. Miller" <davem@davemloft.net>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [patch] fix error paths in cfg80211_wext_siwscan()
Date: Wed, 23 Dec 2009 15:29:37 +0200 [thread overview]
Message-ID: <20091223132937.GG17923@bicker> (raw)
The new code calls kfree(creq) and on the wreq->essid_len > IEEE80211_MAX_SSID_LEN
case it also unlocks the rdev lock.
This was found with a static checker and compile tested only. :/
Signed-off-by: Dan Carpenter <error27@gmail.com>
--- orig/net/wireless/scan.c 2009-12-23 08:38:15.000000000 +0200
+++ devel/net/wireless/scan.c 2009-12-23 08:50:15.000000000 +0200
@@ -685,7 +685,7 @@ int cfg80211_wext_siwscan(struct net_dev
/* No channels found? */
if (!i) {
err = -EINVAL;
- goto out;
+ goto out1;
}
/* Set real number of channels specified in creq->channels[] */
@@ -694,8 +694,10 @@ int cfg80211_wext_siwscan(struct net_dev
/* translate "Scan for SSID" request */
if (wreq) {
if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
- if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
- return -EINVAL;
+ if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
+ err = -EINVAL;
+ goto out1;
+ }
memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
creq->ssids[0].ssid_len = wreq->essid_len;
}
@@ -705,6 +707,7 @@ int cfg80211_wext_siwscan(struct net_dev
rdev->scan_req = creq;
err = rdev->ops->scan(wiphy, dev, creq);
+out1:
if (err) {
rdev->scan_req = NULL;
kfree(creq);
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: Johannes Berg <johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
Cc: "John W. Linville"
<linville-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org>,
"David S. Miller" <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>,
linux-wireless-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: [patch] fix error paths in cfg80211_wext_siwscan()
Date: Wed, 23 Dec 2009 15:29:37 +0200 [thread overview]
Message-ID: <20091223132937.GG17923@bicker> (raw)
The new code calls kfree(creq) and on the wreq->essid_len > IEEE80211_MAX_SSID_LEN
case it also unlocks the rdev lock.
This was found with a static checker and compile tested only. :/
Signed-off-by: Dan Carpenter <error27-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
--- orig/net/wireless/scan.c 2009-12-23 08:38:15.000000000 +0200
+++ devel/net/wireless/scan.c 2009-12-23 08:50:15.000000000 +0200
@@ -685,7 +685,7 @@ int cfg80211_wext_siwscan(struct net_dev
/* No channels found? */
if (!i) {
err = -EINVAL;
- goto out;
+ goto out1;
}
/* Set real number of channels specified in creq->channels[] */
@@ -694,8 +694,10 @@ int cfg80211_wext_siwscan(struct net_dev
/* translate "Scan for SSID" request */
if (wreq) {
if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
- if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
- return -EINVAL;
+ if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
+ err = -EINVAL;
+ goto out1;
+ }
memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
creq->ssids[0].ssid_len = wreq->essid_len;
}
@@ -705,6 +707,7 @@ int cfg80211_wext_siwscan(struct net_dev
rdev->scan_req = creq;
err = rdev->ops->scan(wiphy, dev, creq);
+out1:
if (err) {
rdev->scan_req = NULL;
kfree(creq);
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next reply other threads:[~2009-12-23 13:29 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-12-23 13:29 Dan Carpenter [this message]
2009-12-23 13:29 ` [patch] fix error paths in cfg80211_wext_siwscan() Dan Carpenter
2009-12-23 14:33 ` [PATCH] cfg80211: fix error path in cfg80211_wext_siwscan Johannes Berg
2009-12-23 14:33 ` Johannes Berg
2009-12-23 14:46 ` Dan Carpenter
2009-12-23 14:46 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20091223132937.GG17923@bicker \
--to=error27@gmail.com \
--cc=davem@davemloft.net \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.