linux-kernel - [BUG] rtlwifi: Resource leaks in error handling code of rtl_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <508009c2-6ebf-6c11-1f52-ef488c70ce32@gmail.com>
Date:   Tue, 14 May 2019 20:55:31 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     pkshih@...ltek.com, kvalo@...eaurora.org, davem@...emloft.net
Cc:     linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: [BUG] rtlwifi: Resource leaks in error handling code of
 rtl_pci_probe()

In rtl_pci_probe(), rtl_pci_init() allocates some resources, such as:
_rtl_pci_init_trx_ring
   _rtl_pci_init_rx_ring
     _rtl_pci_init_rx_ring
       pci_zalloc_consistent() -- resource
       _rtl_pci_init_one_rxdesc
         dev_alloc_skb() -- resource

_rtl_pci_init_trx_ring
   _rtl_pci_init_tx_ring
     pci_zalloc_consistent() -- resource

When ieee80211_register_hw() or rtl_pci_intr_mode_decide() fails, these 
resources are not released in error handling code.

A possible fix is to call rtl_pci_deinit() in error handling code, but I 
am not sure whether this is correct.
Thus, I only report the bugs.

These bugs are found by a runtime fuzzing tool named FIZZER written by us.


Best wishes,
Jia-Ju Bai