Commit a10fc629 authored by Zhipeng Lu's avatar Zhipeng Lu Committed by Zhang Changzhong
Browse files

wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() 

stable inclusion
from stable-v5.10.214
commit f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98R
CVE: CVE-2024-35828

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7



--------------------------------

[ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ]

In the for statement of lbs_allocate_cmd_buffer(), if the allocation of
cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to
be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().

Fixes: 876c9d3a ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent d8a3bc61

drivers/net/wireless/marvell/libertas/cmd.c

+11 −2
Original line number Diff line number Diff line
@@ -1133,7 +1133,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) 
		if (!cmdarray[i].cmdbuf) {

			lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");

			ret = -1;

			goto done;

			goto free_cmd_array;

		}

	}
@@ -1141,8 +1141,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv) 
		init_waitqueue_head(&cmdarray[i].cmdwait_q);

		lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]);

	}

	ret = 0;

	return 0;



free_cmd_array:

	for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {

		if (cmdarray[i].cmdbuf) {

			kfree(cmdarray[i].cmdbuf);

			cmdarray[i].cmdbuf = NULL;

		}

	}

	kfree(priv->cmd_array);

	priv->cmd_array = NULL;

done:

	return ret;

}