renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-18 18:43:59 +08:00
Code

staging: rtl8188eu: fix potential leak in rtw_mp_pwrtrk()

Browse Source 
Function rtw_mp_pwrtrk() dynamically allocates a temporary buffer that
is not freed in all error paths. Use a centralized exit path and make sure
that all memory is freed correctly. Detected by Coverity - 1077715.

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Christian Engelmayer 2014-05-07 21:34:37 +02:00 committed by Greg Kroah-Hartman
parent c98acd000b
commit e0e2c5cde5
1 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
View File

@ -7119,15 +7119,15 @@ static int rtw_mp_pwrtrk(struct net_device *dev,
{ {
u8 enable; u8 enable;
u32 thermal; u32 thermal;
s32 ret;
struct adapter *padapter = rtw_netdev_priv(dev); struct adapter *padapter = rtw_netdev_priv(dev);
char *input = kmalloc(wrqu->length, GFP_KERNEL); char *input = kmalloc(wrqu->length, GFP_KERNEL);
int ret = 0;
if (!input) if (!input)
return -ENOMEM; return -ENOMEM;
if (copy_from_user(input, wrqu->pointer, wrqu->length)) { if (copy_from_user(input, wrqu->pointer, wrqu->length)) {
kfree(input); ret = -EFAULT;
return -EFAULT; goto exit;
} }
_rtw_memset(extra, 0, wrqu->length); _rtw_memset(extra, 0, wrqu->length);
@ -7138,22 +7138,28 @@ static int rtw_mp_pwrtrk(struct net_device *dev,
sprintf(extra, "mp tx power tracking stop"); sprintf(extra, "mp tx power tracking stop");
} else if (sscanf(input, "ther =%d", &thermal)) { } else if (sscanf(input, "ther =%d", &thermal)) {
ret = Hal_SetThermalMeter(padapter, (u8)thermal); ret = Hal_SetThermalMeter(padapter, (u8)thermal);
if (ret == _FAIL) if (ret == _FAIL) {
return -EPERM; ret = -EPERM;
goto exit;
}
sprintf(extra, "mp tx power tracking start, target value =%d ok ", thermal); sprintf(extra, "mp tx power tracking start, target value =%d ok ", thermal);
} else { } else {
kfree(input); ret = -EINVAL;
return -EINVAL; goto exit;
} }
} }
kfree(input);
ret = Hal_SetPowerTracking(padapter, enable); ret = Hal_SetPowerTracking(padapter, enable);
if (ret == _FAIL) if (ret == _FAIL) {
return -EPERM; ret = -EPERM;
goto exit;
}
wrqu->length = strlen(extra); wrqu->length = strlen(extra);
return 0;
exit:
kfree(input);
return ret;
} }
static int rtw_mp_psd(struct net_device *dev, static int rtw_mp_psd(struct net_device *dev,