提交 51f5f8ca 编写于 作者: E Eric Dumazet 提交者: John W. Linville

mac80211: Fix memory leak in ieee80211_if_write()

Fix memory leak and use kmalloc() instead of kzalloc() as we are going
to overwrite the allocated buffer.
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 2a13052f
...@@ -48,20 +48,24 @@ static ssize_t ieee80211_if_write( ...@@ -48,20 +48,24 @@ static ssize_t ieee80211_if_write(
ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int)) ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
{ {
u8 *buf; u8 *buf;
ssize_t ret = -ENODEV; ssize_t ret;
buf = kzalloc(count, GFP_KERNEL); buf = kmalloc(count, GFP_KERNEL);
if (!buf) if (!buf)
return -ENOMEM; return -ENOMEM;
ret = -EFAULT;
if (copy_from_user(buf, userbuf, count)) if (copy_from_user(buf, userbuf, count))
return -EFAULT; goto freebuf;
ret = -ENODEV;
rtnl_lock(); rtnl_lock();
if (sdata->dev->reg_state == NETREG_REGISTERED) if (sdata->dev->reg_state == NETREG_REGISTERED)
ret = (*write)(sdata, buf, count); ret = (*write)(sdata, buf, count);
rtnl_unlock(); rtnl_unlock();
freebuf:
kfree(buf);
return ret; return ret;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册