wifi: nxpwifi: handle authentication frame allocation failures

Browse source

nxpwifi_cfg80211_authenticate() allocates the buffer it builds the
management frame in and never checks the result:

	mgmt = kzalloc(frame_len, GFP_KERNEL);

	skb = dev_alloc_skb(...);
	if (!skb) {
		...
		return -ENOMEM;
	}
	...
	memcpy(mgmt->da, req->bss->bssid, ETH_ALEN);

On allocation failure the memcpy() a dozen lines later dereferences NULL.
The same sequence leaks mgmt when dev_alloc_skb() fails: that path
returns without freeing it, while the success path drops it after
nxpwifi_form_mgmt_frame().

Bail out when the allocation fails, and free it before returning on the
skb error path.

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

...

This commit is contained in:

Linmao Li 2026-08-20 16:16:34 +08:00 • committed by Jeff Chen

parent 7769bb2457

commit 7fa5fb9976

1 changed files with 3 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

drivers/net/wireless/nxp/nxpwifi/cfg80211.c

View file