From a2ced2a0a04b07f6cca687800cd6c5ea61e20de5 Mon Sep 17 00:00:00 2001 From: Navid Emamdoost Date: Wed, 20 Nov 2019 16:19:58 +0800 Subject: [PATCH] rsi: release skb if rsi_prepare_beacon fails mainline inclusion from mainline-v5.4 commit d563131ef23cbc756026f839a82598c8445bc45f category: bugfix bugzilla: 13690 CVE: CVE-2019-19071 ------------------------------------------------- In rsi_send_beacon, if rsi_prepare_beacon fails the allocated skb should be released. Signed-off-by: Navid Emamdoost Signed-off-by: Kalle Valo Signed-off-by: Yang Yingliang Reviewed-by: Kefeng Wang Signed-off-by: Yang Yingliang --- drivers/net/wireless/rsi/rsi_91x_mgmt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c index 1095df7d9573..1a3a5235cfb8 100644 --- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c +++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c @@ -1583,6 +1583,7 @@ static int rsi_send_beacon(struct rsi_common *common) skb_pull(skb, (64 - dword_align_bytes)); if (rsi_prepare_beacon(common, skb)) { rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n"); + dev_kfree_skb(skb); return -EINVAL; } skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb); -- GitLab