Commit 219d1d28 authored by Hangyu Hua's avatar Hangyu Hua Committed by Zheng Zengkai
Browse files

yam: fix a memory leak in yam_siocdevprivate() 

mainline inclusion
from mainline-v5.17-rc2
commit 29eb3154
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I4U4NY


CVE: CVE-2022-24959

-------------------------------------------------

ym needs to be free when ym->cmd != SIOCYAMSMCS.

Fixes: 0781168e ("yam: fix a missing-check bug")
Signed-off-by: default avatarHangyu Hua <hbh25y@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>

conflict:
	The bug is in function yam_siocdevprivate() in mainline,
but it is in function yam_ioctl() because the function name is
changed in 25ec92fb("hamradio: use ndo_siocdevprivate") in
mainline.

Signed-off-by: default avatarLu Wei <luwei32@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 00b006d8

drivers/net/hamradio/yam.c

+1 −3
Original line number Diff line number Diff line
@@ -951,9 +951,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
				 sizeof(struct yamdrv_ioctl_mcs));

		if (IS_ERR(ym))

			return PTR_ERR(ym);

		if (ym->cmd != SIOCYAMSMCS)

			return -EINVAL;

		if (ym->bitrate > YAM_MAXBITRATE) {

		if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) {

			kfree(ym);

			return -EINVAL;

		}