1 files changed, 14 insertions, 3 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 31d265f36d2c..ea74b9dd9d82 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1527,12 +1527,18 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
         struct cfg80211_registered_device *dev;
         s64 filter_wiphy = -1;
         bool split = false;
-        struct nlattr **tb = nl80211_fam.attrbuf;
+        struct nlattr **tb;
         int res;
 
+        /* will be zeroed in nlmsg_parse() */
+        tb = kmalloc(sizeof(*tb) * (NL80211_ATTR_MAX + 1), GFP_KERNEL);
+        if (!tb)
+                return -ENOMEM;
+
         rtnl_lock();
+
         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
-                          tb, nl80211_fam.maxattr, nl80211_policy);
+                          tb, NL80211_ATTR_MAX, nl80211_policy);
         if (res == 0) {
                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
                 if (tb[NL80211_ATTR_WIPHY])
@@ -1544,8 +1550,11 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 
                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
-                        if (!netdev)
+                        if (!netdev) {
+                                rtnl_unlock();
+                                kfree(tb);
                                 return -ENODEV;
+                        }
                         if (netdev->ieee80211_ptr) {
                                 dev = wiphy_to_dev(
                                         netdev->ieee80211_ptr->wiphy);
@@ -1554,6 +1563,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                         dev_put(netdev);
                 }
         }
+        kfree(tb);
 
         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
@@ -1589,6 +1599,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                                     !skb->len &&
                                     cb->min_dump_alloc < 4096) {
                                         cb->min_dump_alloc = 4096;
+                                        rtnl_unlock();
                                         return 1;
                                 }
                                 idx--;