From 3dad0d1e40285fb8a5c6b878c5ac5eb556f9dd9e Mon Sep 17 00:00:00 2001 From: Christian Engelmayer Date: Wed, 7 May 2014 21:32:30 +0200 Subject: [PATCH] staging: rtl8188eu: fix potential leak in rtw_mp_QueryDrv() Function rtw_mp_QueryDrv() dynamically allocates a temporary buffer that is not freed in all error paths. Use a centralized exit path and make sure that all memory is freed correctly. Detected by Coverity - CID 1077713. Signed-off-by: Christian Engelmayer Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c index 1bd476dd81e7..8b1579ba4ca0 100644 --- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c @@ -7350,12 +7350,15 @@ static int rtw_mp_QueryDrv(struct net_device *dev, char *input = kmalloc(wrqu->data.length, GFP_KERNEL); u8 qAutoLoad = 1; struct eeprom_priv *pEEPROM = GET_EEPROM_EFUSE_PRIV(padapter); + int ret = 0; if (!input) return -ENOMEM; - if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) - return -EFAULT; + if (copy_from_user(input, wrqu->data.pointer, wrqu->data.length)) { + ret = -EFAULT; + goto exit; + } DBG_88E("%s:iwpriv in =%s\n", __func__, input); qAutoLoad = strncmp(input, "autoload", 8); /* strncmp true is 0 */ @@ -7369,8 +7372,10 @@ static int rtw_mp_QueryDrv(struct net_device *dev, sprintf(extra, "ok"); } wrqu->data.length = strlen(extra) + 1; + +exit: kfree(input); - return 0; + return ret; } static int rtw_mp_set(struct net_device *dev, -- 2.34.1