cfg80211: fix leaks of wdev->conn->ie
authorDavid Kilroy <kilroyd@googlemail.com>
Tue, 18 Aug 2009 23:43:31 +0000 (00:43 +0100)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 20 Aug 2009 15:36:06 +0000 (11:36 -0400)
This only occurs in the following error situations:
 - driver calls connect_result with failure
 - error scheduling authentication on connect
 - error initiating scan (to get BSSID and channel) on
   connect
 - userspace calls disconnect while in the SCANNING or
   SCAN_AGAIN states

Signed-off-by: David Kilroy <kilroyd@googlemail.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/wireless/sme.c

index 6fb6a704ca403204ede05344b7442cbfb10898c9..9ddc00e3c23928e441bc502f322eb5f59e7533b3 100644 (file)
@@ -395,6 +395,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 
        if (status != WLAN_STATUS_SUCCESS) {
                wdev->sme_state = CFG80211_SME_IDLE;
+               if (wdev->conn)
+                       kfree(wdev->conn->ie);
                kfree(wdev->conn);
                wdev->conn = NULL;
                kfree(wdev->connect_keys);
@@ -779,6 +781,7 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                        }
                }
                if (err) {
+                       kfree(wdev->conn->ie);
                        kfree(wdev->conn);
                        wdev->conn = NULL;
                        wdev->sme_state = CFG80211_SME_IDLE;
@@ -848,6 +851,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                    (wdev->conn->state == CFG80211_CONN_SCANNING ||
                     wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)) {
                        wdev->sme_state = CFG80211_SME_IDLE;
+                       kfree(wdev->conn->ie);
                        kfree(wdev->conn);
                        wdev->conn = NULL;
                        wdev->ssid_len = 0;