From dfac77baa2837a9a4ac66015234854ebccb85bf1 Mon Sep 17 00:00:00 2001 From: Larry Finger Date: Fri, 6 Aug 2021 16:32:35 -0500 Subject: [PATCH] staging: r8188eu: Fix potential memory leak or NULL dereference In routine c2h_wk_callback(() following a kmalloc() call, the error recovery is flawed. If the kmalloc() returns a pointer that is not NULL, and the following c2h_evt_read() fails, the code will leak that buffer. If the kmalloc() fails, a NULL dereference will occur in the following code. Reported-by: Dan Carpenter Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20210806213235.22349-1-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman --- drivers/staging/r8188eu/core/rtw_cmd.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/staging/r8188eu/core/rtw_cmd.c b/drivers/staging/r8188eu/core/rtw_cmd.c index c3a9051ca10c..238ae79f4141 100644 --- a/drivers/staging/r8188eu/core/rtw_cmd.c +++ b/drivers/staging/r8188eu/core/rtw_cmd.c @@ -1908,8 +1908,12 @@ static void c2h_wk_callback(struct work_struct *work) c2h_evt = kmalloc(16, GFP_KERNEL); if (c2h_evt) { /* This C2H event is not read, read & clear now */ - if (c2h_evt_read(adapter, (u8 *)c2h_evt) != _SUCCESS) + if (c2h_evt_read(adapter, (u8 *)c2h_evt) != _SUCCESS) { + kfree(c2h_evt); continue; + } + } else { + return; } }