mac80211_hwsim: fix memory leak in hwsim_new_radio_nl

zhengchaoshao · jmberg-intel · commit 098abbd48ec1 · 2023-05-16T10:29:34.000-07:00
When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources applied for by pmsr_capa are not released. Add release processing to the incorrect path. Fixes: 92d1338 ("mac80211_hwsim: add PMSR capability support") Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> Reviewed-by: Simon Horman <simon.horman@corigine.com> Link: https://lore.kernel.org/r/20230515092227.2691437-1-shaozhengchao@huawei.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -5964,10 +5964,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
 			ret = -ENOMEM;
 			goto out_free;
 		}
+		param.pmsr_capa = pmsr_capa;
+
 		ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);
 		if (ret)
 			goto out_free;
-		param.pmsr_capa = pmsr_capa;
 	}
 
 	ret = mac80211_hwsim_new_radio(info, &param);

Original file line number	Diff line number	Diff line change
`@@ -5964,10 +5964,11 @@ static int hwsim_new_radio_nl(struct sk_buff msg, struct genl_info info)`
`5964`	`5964`	`ret = -ENOMEM;`
`5965`	`5965`	`goto out_free;`
`5966`	`5966`	`}`
	`5967`	`+ param.pmsr_capa = pmsr_capa;`
	`5968`	`+`
`5967`	`5969`	`ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info);`
`5968`	`5970`	`if (ret)`
`5969`	`5971`	`goto out_free;`
`5970`		`- param.pmsr_capa = pmsr_capa;`
`5971`	`5972`	`}`
`5972`	`5973`
`5973`	`5974`	`ret = mac80211_hwsim_new_radio(info, &param);`