From: Hangyu Hua <hbh25y@gmail.com>
Date: Mon, 24 Jan 2022 03:29:54 +0000 (+0800)
Subject: yam: fix a memory leak in yam_siocdevprivate()
X-Git-Tag: archive/raspbian/5.10.92-2+rpi1^2~19
X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks:///%22http:/www.example.com/cgi/%22https:/%22bookmarks:/?a=commitdiff_plain;h=0b5d9f15e01ded01629fa5baa602e32e79818664;p=linux.git

yam: fix a memory leak in yam_siocdevprivate()

Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=729e54636b3ebefb77796702a5b1f1ed5586895e
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-24959

[ Upstream commit 29eb31542787e1019208a2e1047bb7c76c069536 ]

ym needs to be free when ym->cmd != SIOCYAMSMCS.

Fixes: 0781168e23a2 ("yam: fix a missing-check bug")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name yam-fix-a-memory-leak-in-yam_siocdevprivate.patch
---

diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index b05798b5f5e..1d1f802e5e3 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -948,9 +948,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 				 sizeof(struct yamdrv_ioctl_mcs));
 		if (IS_ERR(ym))
 			return PTR_ERR(ym);
-		if (ym->cmd != SIOCYAMSMCS)
-			return -EINVAL;
-		if (ym->bitrate > YAM_MAXBITRATE) {
+		if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) {
 			kfree(ym);
 			return -EINVAL;
 		}