summaryrefslogtreecommitdiffstats
path: root/kernel/drivers/net/wireless/brcm80211/brcmfmac
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/drivers/net/wireless/brcm80211/brcmfmac')
-rw-r--r--kernel/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c4
-rw-r--r--kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c7
2 files changed, 8 insertions, 3 deletions
diff --git a/kernel/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/kernel/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 410a6645d..59cef6c69 100644
--- a/kernel/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/kernel/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
return -ENOMEM;
err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
glom_skb);
- if (err)
+ if (err) {
+ brcmu_pkt_buf_free_skb(glom_skb);
goto done;
+ }
skb_queue_walk(pktq, skb) {
memcpy(skb->data, glom_skb->data, skb->len);
diff --git a/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index deb5f78dc..70a698533 100644
--- a/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -2408,7 +2408,7 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
WL_BSS_INFO_MAX);
if (err) {
brcmf_err("Failed to get bss info (%d)\n", err);
- return;
+ goto out_kfree;
}
si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
@@ -2420,6 +2420,9 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
+
+out_kfree:
+ kfree(buf);
}
static s32
@@ -4099,7 +4102,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
(u8 *)&settings->beacon.head[ie_offset],
settings->beacon.head_len - ie_offset,
WLAN_EID_SSID);
- if (!ssid_ie)
+ if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
return -EINVAL;
memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);