提交 b9cabe52 编写于 作者: J Jesper Juhl 提交者: David S. Miller

ieee802154: Don't leak memory in ieee802154_nl_fill_phy

In net/ieee802154/nl-phy.c::ieee802154_nl_fill_phy() I see two small
issues.
1) If the allocation of 'buf' fails we may just as well return -EMSGSIZE
   directly rather than jumping to 'out:' and do a pointless kfree(0).
2) We do not free 'buf' unless we jump to one of the error labels and this
   leaks memory.
This patch should address both.
Signed-off-by: NJesper Juhl <jj@chaosbits.net>
Acked-by: NDmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: NDavid S. Miller <davem@conan.davemloft.net>
上级 84860c72
...@@ -44,7 +44,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid, ...@@ -44,7 +44,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
pr_debug("%s\n", __func__); pr_debug("%s\n", __func__);
if (!buf) if (!buf)
goto out; return -EMSGSIZE;
hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags, hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags,
IEEE802154_LIST_PHY); IEEE802154_LIST_PHY);
...@@ -65,6 +65,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid, ...@@ -65,6 +65,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
pages * sizeof(uint32_t), buf); pages * sizeof(uint32_t), buf);
mutex_unlock(&phy->pib_lock); mutex_unlock(&phy->pib_lock);
kfree(buf);
return genlmsg_end(msg, hdr); return genlmsg_end(msg, hdr);
nla_put_failure: nla_put_failure:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册