Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Brian Norris <briannorris@chromium.org>
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     linux-wireless@vger.kernel.org,
        Brian Norris <briannorris@chromium.org>,
        John Crispin <john@phrozen.org>
Subject: [PATCH] iw: scan: fix double-free in error paths
Date:   Thu, 21 Nov 2019 14:41:39 -0800
Message-Id: <20191121224139.58281-1-briannorris@chromium.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Hit when, for instance, I'm stupid enough to type an invalid scan
command:

  # iw wlan0 scan -h
  BUG at file position lib/msg.c:572:void nlmsg_free(struct nl_msg *)
  iw: lib/msg.c:572: void nlmsg_free(struct nl_msg *): Assertion `0' failed.
  Aborted (core dumped)

Fixes: 2f74c59cf11e ("iw: fix memory leaks inside handle_scan")
Cc: John Crispin <john@phrozen.org>
Signed-off-by: Brian Norris <briannorris@chromium.org>
---
 scan.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/scan.c b/scan.c
index 1418da73a624..bfd39e4b1a1c 100644
--- a/scan.c
+++ b/scan.c
@@ -448,8 +448,6 @@ static int handle_scan(struct nl80211_state *state,
 			}
 			/* fall through - this is an error */
 		case DONE:
-			nlmsg_free(ssids);
-			nlmsg_free(freqs);
 			err = 1;
 			goto nla_put_failure;
 		case FREQ:
-- 
2.24.0.432.g9d3f5f5b63-goog