In the function query_regdb_file() the alpha2 parameter is duplicated
using kmemdup() and subsequently freed in regdb_fw_cb(). However,
request_firmware_nowait() can fail without calling regdb_fw_cb() and
thus leak memory.
Fixes: 007f6c5e6eb4 ("cfg80211: support loading regulatory database as
firmware file")
Signed-off-by: Arend van Spriel <[email protected]>
---
net/wireless/reg.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index ec25924a1c26..f629c2e15fea 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1080,6 +1080,8 @@ static void regdb_fw_cb(const struct firmware
*fw, void *context)
static int query_regdb_file(const char *alpha2)
{
+ int err;
+
ASSERT_RTNL();
if (regdb)
@@ -1089,9 +1091,13 @@ static int query_regdb_file(const char *alpha2)
if (!alpha2)
return -ENOMEM;
- return request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
- ®_pdev->dev, GFP_KERNEL,
- (void *)alpha2, regdb_fw_cb);
+ err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db",
+ ®_pdev->dev, GFP_KERNEL,
+ (void *)alpha2, regdb_fw_cb);
+ if (err)
+ kfree(alpha2);
+
+ return err;
}
int reg_reload_regdb(void)
--
2.35.1
Arend van Spriel <[email protected]> writes:
> In the function query_regdb_file() the alpha2 parameter is duplicated
> using kmemdup() and subsequently freed in regdb_fw_cb(). However,
> request_firmware_nowait() can fail without calling regdb_fw_cb() and
> thus leak memory.
>
> Fixes: 007f6c5e6eb4 ("cfg80211: support loading regulatory database as
> firmware file")
The fixes tag should be in one line.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
On 10/24/2022 11:49 AM, Kalle Valo wrote:
> Arend van Spriel <[email protected]> writes:
>
>> In the function query_regdb_file() the alpha2 parameter is duplicated
>> using kmemdup() and subsequently freed in regdb_fw_cb(). However,
>> request_firmware_nowait() can fail without calling regdb_fw_cb() and
>> thus leak memory.
>>
>> Fixes: 007f6c5e6eb4 ("cfg80211: support loading regulatory database as
>> firmware file")
>
> The fixes tag should be in one line.
Correct,which is why I sent a V2 ;-)
Regards,
Arend