linux-cve-announce - CVE-2022-49312: staging: rtl8712: fix a potential memory leak in r871xu_drv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022636-CVE-2022-49312-6cea@gregkh>
Date: Wed, 26 Feb 2025 03:09:46 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49312: staging: rtl8712: fix a potential memory leak in r871xu_drv_init()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8712: fix a potential memory leak in r871xu_drv_init()

In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory
allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not
properly released as there is no action will be performed by
r8712_usb_dvobj_deinit().
To properly release it, we should call r8712_free_io_queue() in
r8712_usb_dvobj_deinit().

Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called
by r871x_dev_unload() under condition `padapter->bup` and
r8712_free_io_queue() is called by r8712_free_drv_sw().
However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and
calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for
better understading the code.
So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove
r8712_free_io_queue() from r8712_free_drv_sw().

The Linux kernel CVE team has assigned CVE-2022-49312 to this issue.

Affected and fixed versions
===========================

	Fixed in 5.10.122 with commit 5a89a92efc342dd7c44b6056da87debc598f9c73
	Fixed in 5.15.47 with commit 8eb42d6d10f8fe509117859defddf9e72b4fa4d0
	Fixed in 5.17.15 with commit 205e039fead72e87ad2838f5e649a4c4834f648b
	Fixed in 5.18.4 with commit a2882b8baad068d21c99fb2ab5a85a2bdbd5b834
	Fixed in 5.19 with commit 7288ff561de650d4139fab80e9cb0da9b5b32434

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49312
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/rtl8712/os_intfs.c
	drivers/staging/rtl8712/usb_intf.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5a89a92efc342dd7c44b6056da87debc598f9c73
	https://git.kernel.org/stable/c/8eb42d6d10f8fe509117859defddf9e72b4fa4d0
	https://git.kernel.org/stable/c/205e039fead72e87ad2838f5e649a4c4834f648b
	https://git.kernel.org/stable/c/a2882b8baad068d21c99fb2ab5a85a2bdbd5b834
	https://git.kernel.org/stable/c/7288ff561de650d4139fab80e9cb0da9b5b32434