linux-kernel - Re: [PATCH] staging: rtl8192e: rtllib_module: Fix memory leak in alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191215132330.GB10631@localhost>
Date:   Sun, 15 Dec 2019 14:23:30 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Navid Emamdoost <navid.emamdoost@...il.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Sandhya Bankar <bankarsandhya512@...il.com>,
        Hildo Guillardi Júnior <hildogjr@...il.com>,
        Hariprasad Kelam <hariprasad.kelam@...il.com>,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        emamd001@....edu
Subject: Re: [PATCH] staging: rtl8192e: rtllib_module: Fix memory leak in
 alloc_rtllib

On Sat, Dec 14, 2019 at 05:05:58PM -0600, Navid Emamdoost wrote:
> In the implementation of alloc_rtllib() the allocated dev is leaked in
> case of ieee->pHTInfo allocation failure. Release via free_netdev(dev).
> 
> Fixes: 6869a11bff1d ("Staging: rtl8192e: Use !x instead of x == NULL")

This is not the commit that introduced this issue.

> Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
> ---
>  drivers/staging/rtl8192e/rtllib_module.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/rtl8192e/rtllib_module.c b/drivers/staging/rtl8192e/rtllib_module.c
> index 64d9feee1f39..18d898714c5c 100644
> --- a/drivers/staging/rtl8192e/rtllib_module.c
> +++ b/drivers/staging/rtl8192e/rtllib_module.c
> @@ -125,7 +125,7 @@ struct net_device *alloc_rtllib(int sizeof_priv)
>  
>  	ieee->pHTInfo = kzalloc(sizeof(struct rt_hi_throughput), GFP_KERNEL);
>  	if (!ieee->pHTInfo)
> -		return NULL;
> +		goto failed;

And you're still leaking ieee->networks and possibly a bunch of other
allocations here. You need to call at least rtllib_networks_free() in
the error path.

>  
>  	HTUpdateDefaultSetting(ieee);
>  	HTInitializeHTInfo(ieee);

Johan