diff options
| author | Srinivas Dasari <dasaris@codeaurora.org> | 2020-04-13 12:52:10 +0530 |
|---|---|---|
| committer | Sunil Ravi <sunilravi@google.com> | 2020-04-21 02:51:10 +0000 |
| commit | bb6b3cf755adeee89370f3589d369c5a7b85f902 (patch) | |
| tree | 6f39cff4998fc1f1a897fdeb1321a81d94cad67c | |
| parent | 3f9e5fb892aa8d7f986cbc25f210e430c3fc30e2 (diff) | |
| download | qcacld-bb6b3cf755adeee89370f3589d369c5a7b85f902.tar.gz | |
qcacld-3.0: Fix possible memleak in send_assoc_req
Allocated a memory to hold the mbo IEs stripped from IEs received
from userspace. But this buffer is not freed in all failure cases.
Move the freeing to a common label "end" to free the buffer in
all cases.
Bug: 153759907
Change-Id: I7ad268fed1898ac9f62e30eb4bd3740cce9bb4bc
CRs-Fixed: 2662225
Signed-off-by: Sunil Ravi <sunilravi@google.com>
| -rw-r--r-- | core/mac/src/pe/lim/lim_send_management_frames.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c index 4122b16117..033243445e 100644 --- a/core/mac/src/pe/lim/lim_send_management_frames.c +++ b/core/mac/src/pe/lim/lim_send_management_frames.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2018, 2020 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -1948,7 +1948,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx, mbo_ie, DOT11F_IE_MBO_IE_MAX_LEN); if (sir_status != eSIR_SUCCESS) { pe_err("Failed to strip MBO IE"); - goto free_mbo_ie; + goto end; } /* Include the EID and length fields */ @@ -2098,12 +2098,8 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx, /* Pkt will be freed up by the callback */ goto end; } - -free_mbo_ie: - if (mbo_ie) - qdf_mem_free(mbo_ie); - end: + qdf_mem_free(mbo_ie); /* Free up buffer allocated for mlm_assoc_req */ qdf_mem_free(mlm_assoc_req); mlm_assoc_req = NULL; |