Commit 8223ac19 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: fix memory leaks with element parsing 



My previous commit 5d24828d ("mac80211: always allocate
struct ieee802_11_elems") had a few bugs and leaked the new
allocated struct in a few error cases, fix that.

Fixes: 5d24828d ("mac80211: always allocate struct ieee802_11_elems")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Link: https://lore.kernel.org/r/20211001211108.9839928e42e0.Ib81ca187d3d3af7ed1bfeac2e00d08a4637c8025@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 10de5a59

net/mac80211/agg-rx.c

+2 −1
Original line number Diff line number Diff line
@@ -498,13 +498,14 @@ void ieee80211_process_addba_request(struct ieee80211_local *local, 
		elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,

					       ies_len, true, mgmt->bssid, NULL);

		if (!elems || elems->parse_error)

			return;

			goto free;

	}



	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,

					start_seq_num, ba_policy, tid,

					buf_size, true, false,

					elems ? elems->addba_ext_ie : NULL);

free:

	kfree(elems);

}

net/mac80211/ibss.c

+5 −5
Original line number Diff line number Diff line
@@ -1659,11 +1659,11 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 
				mgmt->u.action.u.chan_switch.variable,

				ies_len, true, mgmt->bssid, NULL);



			if (!elems || elems->parse_error)

				break;



			ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,

							rx_status, elems);

			if (elems && !elems->parse_error)

				ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt,

								skb->len,

								rx_status,

								elems);

			kfree(elems);

			break;

		}

net/mac80211/mlme.c

+18 −18
Original line number Diff line number Diff line
@@ -3353,8 +3353,10 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, 
			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,

					  GFP_ATOMIC);

		rcu_read_unlock();

		if (!bss_ies)

			return false;

		if (!bss_ies) {

			ret = false;

			goto out;

		}



		bss_elems = ieee802_11_parse_elems(bss_ies->data, bss_ies->len,

						   false, mgmt->bssid,
@@ -4331,9 +4333,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 
					mgmt->u.action.u.chan_switch.variable,

					ies_len, true, mgmt->bssid, NULL);



			if (!elems || elems->parse_error)

				break;



			if (elems && !elems->parse_error)

				ieee80211_sta_process_chanswitch(sdata,

								 rx_status->mactime,

								 rx_status->device_timestamp,
@@ -4357,10 +4357,8 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 
					mgmt->u.action.u.ext_chan_switch.variable,

					ies_len, true, mgmt->bssid, NULL);



			if (!elems || elems->parse_error)

				break;



			/* for the handling code pretend this was also an IE */

			if (elems && !elems->parse_error) {

				/* for the handling code pretend it was an IE */

				elems->ext_chansw_ie =

					&mgmt->u.action.u.ext_chan_switch.data;
@@ -4368,6 +4366,8 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, 
								 rx_status->mactime,

								 rx_status->device_timestamp,

								 elems, false);

			}



			kfree(elems);

		}

		break;