linux-kernel - Re: [PATCH] staging: rtl8192u: fix multiple memory leaks on error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEkB2EQJDdE=0HDzL14WDHHuwuaNNjSXEGVm1p7MBopyDvzTzQ@mail.gmail.com>
Date:   Mon, 30 Sep 2019 16:35:14 -0500
From:   Navid Emamdoost <navid.emamdoost@...il.com>
To:     Colin Ian King <colin.king@...onical.com>,
        Nishka Dasgupta <nishkadg.linux@...il.com>
Cc:     Navid Emamdoost <emamd001@....edu>,
        Stephen McCamant <smccaman@....edu>, kjlu@....edu,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: rtl8192u: fix multiple memory leaks on error path

Could you take a look at this patch and confirm it, please?

On Thu, Sep 19, 2019 at 9:51 PM Navid Emamdoost
<navid.emamdoost@...il.com> wrote:
>
> In rtl8192_tx on error handling path allocated urbs and also skb should
> be released.
>
> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
>  drivers/staging/rtl8192u/r8192U_core.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
> index fe1f279ca368..b62b03802b1b 100644
> --- a/drivers/staging/rtl8192u/r8192U_core.c
> +++ b/drivers/staging/rtl8192u/r8192U_core.c
> @@ -1422,7 +1422,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>                 (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN);
>         struct usb_device *udev = priv->udev;
>         int pend;
> -       int status;
> +       int status, rt = -1;
>         struct urb *tx_urb = NULL, *tx_urb_zero = NULL;
>         unsigned int idx_pipe;
>
> @@ -1566,8 +1566,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>                 }
>                 if (bSend0Byte) {
>                         tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC);
> -                       if (!tx_urb_zero)
> -                               return -ENOMEM;
> +                       if (!tx_urb_zero) {
> +                               rt = -ENOMEM;
> +                               goto error;
> +                       }
>                         usb_fill_bulk_urb(tx_urb_zero, udev,
>                                           usb_sndbulkpipe(udev, idx_pipe),
>                                           &zero, 0, tx_zero_isr, dev);
> @@ -1577,7 +1579,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>                                          "Error TX URB for zero byte %d, error %d",
>                                          atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
>                                          status);
> -                               return -1;
> +                               goto error;
>                         }
>                 }
>                 netif_trans_update(dev);
> @@ -1588,7 +1590,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>         RT_TRACE(COMP_ERR, "Error TX URB %d, error %d",
>                  atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
>                  status);
> -       return -1;
> +
> +error:
> +       dev_kfree_skb_any(skb);
> +       usb_free_urb(tx_urb);
> +       usb_free_urb(tx_urb_zero);
> +       return rt;
>  }
>
>  static short rtl8192_usb_initendpoints(struct net_device *dev)
> --
> 2.17.1
>


-- 
Navid.