linux-kernel - Re: [PATCH 5.3 134/166] net: qlogic: Fix memory leak in ql_alloc_large

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 12 Nov 2019 19:42:36 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     Navid Emamdoost <navid.emamdoost@...il.com>,
        "David S. Miller" <davem@...emloft.net>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>
Subject: Re: [PATCH 5.3 134/166] net: qlogic: Fix memory leak in
 ql_alloc_large_buffers

On Sun, 2019-10-06 at 19:21 +0200, Greg Kroah-Hartman wrote:
> From: Navid Emamdoost <navid.emamdoost@...il.com>
> 
> [ Upstream commit 1acb8f2a7a9f10543868ddd737e37424d5c36cf4 ]
> 
> In ql_alloc_large_buffers, a new skb is allocated via netdev_alloc_skb.
> This skb should be released if pci_dma_mapping_error fails.
> 
> Fixes: 0f8ab89e825f ("qla3xxx: Check return code from pci_map_single() in ql_release_to_lrg_buf_free_list(), ql_populate_free_queue(), ql_alloc_large_buffers(), and ql3xxx_send()")
> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> ---
>  drivers/net/ethernet/qlogic/qla3xxx.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> --- a/drivers/net/ethernet/qlogic/qla3xxx.c
> +++ b/drivers/net/ethernet/qlogic/qla3xxx.c
> @@ -2787,6 +2787,7 @@ static int ql_alloc_large_buffers(struct
>  				netdev_err(qdev->ndev,
>  					   "PCI mapping failed with error: %d\n",
>  					   err);
> +				dev_kfree_skb_irq(skb);
>  				ql_free_large_buffers(qdev);

So far as I can see, ql_free_large_buffers() will free the skb since
qdev->lrg_buf[i].skb already points to it.  So there was no memory
leak, and this change introduced a double-free on the error path.

Am I missing something?

Ben.

>  				return -ENOMEM;
>  			}
> 
> 
-- 
Ben Hutchings
I'm not a reverse psychological virus.
Please don't copy me into your signature.


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)