github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-29 17:43:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: p54: Fix memory leak in p54_beacon_update()

Browse Source 
In p54_beacon_update(), beacon is allocated via ieee80211_beacon_get().
If p54_beacon_format_ie_tim() fails, the function returns immediately
without freeing the allocated beacon skb, which would lead to a memory
leak.

Since no other references to this memory exist, it must be freed locally
before returning the error. Fix this by freeing the buffer using
dev_kfree_skb_any() in the error path.

Note that this error path is unreachable in practice because mac80211
guarantees a minimum TIM length of 4 bytes for non-S1G devices. This
change primarily serves to silence static analysis warnings and keep
the error handling logic complete.

Compile tested only. Issue found using a prototype static analysis tool
and code review.

Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://patch.msgid.link/20260122085945.444955-1-zilin@seu.edu.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Zilin Guan 2026-01-22 08:59:45 +00:00 committed by Johannes Berg
parent fd5bfcf430
commit 9b50d9c06c
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/wireless/intersil/p54/main.c
View File

@ -143,8 +143,10 @@ static int p54_beacon_update(struct p54_common *priv,
if (!beacon)
return -ENOMEM;
ret = p54_beacon_format_ie_tim(beacon);
if (ret)
if (ret) {
dev_kfree_skb_any(beacon);
return ret;
}
/*
* During operation, the firmware takes care of beaconing.