Commit b9cabe52 authored by Jesper Juhl's avatar Jesper Juhl Committed by David S. Miller
Browse files

ieee802154: Don't leak memory in ieee802154_nl_fill_phy 



In net/ieee802154/nl-phy.c::ieee802154_nl_fill_phy() I see two small
issues.
1) If the allocation of 'buf' fails we may just as well return -EMSGSIZE
   directly rather than jumping to 'out:' and do a pointless kfree(0).
2) We do not free 'buf' unless we jump to one of the error labels and this
   leaks memory.
This patch should address both.

Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
Acked-by: default avatarDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@conan.davemloft.net>
parent 84860c72

net/ieee802154/nl-phy.c

+2 −1
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid, 
	pr_debug("%s\n", __func__);



	if (!buf)

		goto out;

		return -EMSGSIZE;



	hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags,

		IEEE802154_LIST_PHY);
@@ -65,6 +65,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid, 
				pages * sizeof(uint32_t), buf);



	mutex_unlock(&phy->pib_lock);

	kfree(buf);

	return genlmsg_end(msg, hdr);



nla_put_failure: