From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Navid Emamdoost <navid.emamdoost@gmail.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org,
brcm80211-dev-list.pdl@broadcom.com,
brcm80211-dev-list@cypress.com, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 020/459] brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
Date: Fri, 14 Feb 2020 10:54:30 -0500 [thread overview]
Message-ID: <20200214160149.11681-20-sashal@kernel.org> (raw)
In-Reply-To: <20200214160149.11681-1-sashal@kernel.org>
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 ]
In the implementation of brcmf_p2p_create_p2pdev() the allocated memory
for p2p_vif is leaked when the mac address is the same as primary
interface. To fix this, go to error path to release p2p_vif via
brcmf_free_vif().
Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 7ba9f6a686459..1f5deea5a288e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
/* firmware requires unique mac address for p2pdev interface */
if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
bphy_err(drvr, "discovery vif must be different from primary interface\n");
- return ERR_PTR(-EINVAL);
+ err = -EINVAL;
+ goto fail;
}
brcmf_p2p_generate_bss_mac(p2p, addr);
--
2.20.1
next prev parent reply other threads:[~2020-02-14 16:02 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200214160149.11681-1-sashal@kernel.org>
2020-02-14 15:54 ` [PATCH AUTOSEL 5.4 003/459] ath10k: Fix qmi init error handling Sasha Levin
2020-02-14 15:54 ` [PATCH AUTOSEL 5.4 004/459] wil6210: fix break that is never reached because of zero'ing of a retry counter Sasha Levin
2020-02-14 15:54 ` Sasha Levin [this message]
2020-02-14 15:54 ` [PATCH AUTOSEL 5.4 021/459] brcmfmac: Fix use after free in brcmf_sdio_readframes() Sasha Levin
2020-02-14 15:55 ` [PATCH AUTOSEL 5.4 092/459] ath10k: Correct the DMA direction for management tx buffers Sasha Levin
2020-02-14 15:55 ` [PATCH AUTOSEL 5.4 093/459] rtw88: fix rate mask for 1SS chip Sasha Levin
2020-02-14 15:55 ` [PATCH AUTOSEL 5.4 094/459] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362 Sasha Levin
2020-02-14 15:55 ` [PATCH AUTOSEL 5.4 095/459] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Sasha Levin
2020-02-14 15:55 ` [PATCH AUTOSEL 5.4 096/459] libertas: make lbs_ibss_join_existing() return error code on rates overflow Sasha Levin
2020-02-14 15:56 ` [PATCH AUTOSEL 5.4 145/459] ath10k: correct the tlv len of ath10k_wmi_tlv_op_gen_config_pno_start Sasha Levin
2020-02-14 15:57 ` [PATCH AUTOSEL 5.4 198/459] b43legacy: Fix -Wcast-function-type Sasha Levin
2020-02-14 15:57 ` [PATCH AUTOSEL 5.4 199/459] ipw2x00: " Sasha Levin
2020-02-14 15:57 ` [PATCH AUTOSEL 5.4 200/459] iwlegacy: " Sasha Levin
2020-02-14 15:57 ` [PATCH AUTOSEL 5.4 201/459] rtlwifi: rtl_pci: " Sasha Levin
2020-02-14 15:57 ` [PATCH AUTOSEL 5.4 202/459] bcma: remove set but not used variable 'sizel' Sasha Levin
2020-02-14 15:57 ` [PATCH AUTOSEL 5.4 203/459] orinoco: avoid assertion in case of NULL pointer Sasha Levin
2020-02-14 16:00 ` [PATCH AUTOSEL 5.4 405/459] ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe Sasha Levin
2020-02-14 16:00 ` [PATCH AUTOSEL 5.4 406/459] hostap: Adjust indentation in prism2_hostapd_add_sta Sasha Levin
2020-02-14 16:00 ` [PATCH AUTOSEL 5.4 407/459] rtw88: fix potential NULL skb access in TX ISR Sasha Levin
2020-02-14 16:00 ` [PATCH AUTOSEL 5.4 408/459] rtlwifi: rtl8821ae: remove unused variables Sasha Levin
2020-02-14 16:00 ` [PATCH AUTOSEL 5.4 409/459] rtlwifi: rtl8192ee: " Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 410/459] rtlwifi: rtl8723ae: " Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 411/459] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 417/459] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 418/459] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 442/459] iwlwifi: mvm: Fix thermal zone registration Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 443/459] iwlwifi: mvm: avoid use after free for pmsr request Sasha Levin
2020-02-14 16:01 ` [PATCH AUTOSEL 5.4 444/459] iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200214160149.11681-20-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=brcm80211-dev-list@cypress.com \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=navid.emamdoost@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).