linux-kernel - Re: [PATCH] fix error handling in drivers/staging/rtl8192u/ieee80211/ieee80211

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Sep 2018 11:04:06 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Valdis Kletnieks <valdis.kletnieks@...edu>
Cc:     Greg KH <gregkh@...uxfoundation.org>,
        John Whitmore <arigead@...il.com>,
        kernelnewbies@...nelnewbies.org,
        LKML <linux-kernel@...r.kernel.org>,
        "open list:ANDROID DRIVERS" <devel@...verdev.osuosl.org>
Subject: Re: [PATCH] fix error handling in drivers/staging/rtl8192u/ieee80211/ieee80211_module.c

On Wed, Sep 26, 2018 at 10:52 AM,  <valdis.kletnieks@...edu> wrote:
> John notes that if the kzalloc of ieee->pHTInfo fails, we fail to call
> ieee80211_networks_free().  In addition, that function has an un-needed check
> before kfree().
>
> Reported-by: John Whitmore <arigead@...il.com>
> Signed-off-by: Valdis Kletnieks <valdis.kletnieks@...edu>

Reviewed-by: Kees Cook <keescook@...omium.org>

(And this seems to be the only case of this -- I don't see this code
trivially copy/pasted in other 80211 stacks.)

-Kees


> ---
> diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> index 90a097f2cd4e..97ff0371b5bb 100644
> --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_module.c
> @@ -78,8 +78,6 @@ static inline int ieee80211_networks_allocate(struct ieee80211_device *ieee)
>
>  static inline void ieee80211_networks_free(struct ieee80211_device *ieee)
>  {
> -       if (!ieee->networks)
> -               return;
>         kfree(ieee->networks);
>         ieee->networks = NULL;
>  }
> @@ -180,6 +178,7 @@ struct net_device *alloc_ieee80211(int sizeof_priv)
>         return dev;
>
>   failed:
> +       ieee80211_networks_free(ieee);
>         if (dev)
>                 free_netdev(dev);
>
>



-- 
Kees Cook
Pixel Security