瀏覽代碼

qcacld-3.0: Fix possible memleak of mbo IE in lim_send_assoc_req

Allocated a memory to hold the mbo IEs stripped from IEs received
from userspace. But this buffer is not freed in the below
failure cases,
1. Unpack of assoc request failure
2. Packet alloc failure
3. Packing of assoc request failure
4. Encryption of fils IEs in assoc request failure

So, move the freeing to a common label "end" to free the buffer in
all cases.

Change-Id: I7ad268fed1898ac9f62e30eb4bd3740cce9bb4bc
CRs-Fixed: 2662225
Srinivas Dasari 4 年之前
父節點
當前提交
6cb69d7777
共有 1 個文件被更改,包括 4 次插入7 次删除
  1. 4 7
      core/mac/src/pe/lim/lim_send_management_frames.c

+ 4 - 7
core/mac/src/pe/lim/lim_send_management_frames.c

@@ -2438,7 +2438,7 @@ lim_send_assoc_req_mgmt_frame(struct mac_context *mac_ctx,
 					  mbo_ie, DOT11F_IE_MBO_IE_MAX_LEN);
 		if (QDF_IS_STATUS_ERROR(qdf_status)) {
 			pe_err("Failed to strip MBO IE");
-			goto free_mbo_ie;
+			goto end;
 		}
 
 		/* Include the EID and length fields */
@@ -2466,7 +2466,7 @@ lim_send_assoc_req_mgmt_frame(struct mac_context *mac_ctx,
 					      &adaptive_11r_ie_len);
 	if (QDF_IS_STATUS_ERROR(qdf_status)) {
 		pe_err("Failed to fill adaptive 11r IE");
-		goto free_mbo_ie;
+		goto end;
 	}
 
 	/*
@@ -2572,8 +2572,7 @@ lim_send_assoc_req_mgmt_frame(struct mac_context *mac_ctx,
 						    frame, &payload);
 		if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
 			cds_packet_free((void *)packet);
-			qdf_mem_free(frm);
-			return;
+			goto end;
 		}
 	}
 
@@ -2633,12 +2632,10 @@ lim_send_assoc_req_mgmt_frame(struct mac_context *mac_ctx,
 				pe_session, SENT_FAIL, QDF_STATUS_E_FAILURE);
 		/* Pkt will be freed up by the callback */
 	}
-free_mbo_ie:
-	if (mbo_ie)
-		qdf_mem_free(mbo_ie);
 
 end:
 	qdf_mem_free(rsnx_ie);
+	qdf_mem_free(mbo_ie);
 	qdf_mem_free(mscs_ext_ie);
 
 	/* Free up buffer allocated for mlm_assoc_req */