linux-kernel - [PATCH] staging: r8188eu: Fix potential memory leak or NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20210806213235.22349-1-Larry.Finger@lwfinger.net>
Date:   Fri,  6 Aug 2021 16:32:35 -0500
From:   Larry Finger <Larry.Finger@...inger.net>
To:     gregkh@...uxfoundation.org
Cc:     phil@...lpotter.co.uk, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org,
        Larry Finger <Larry.Finger@...inger.net>,
        Dan Carpenter <dan.carpenter@...cle.com>
Subject: [PATCH] staging: r8188eu: Fix potential memory leak or NULL dereference

In routine c2h_wk_callback(() following a kmalloc() call, the
error recovery is flawed. If the kmalloc() returns a pointer
that is not NULL, and the following c2h_evt_read() fails, the
code will leak that buffer. If the kmalloc() fails, a NULL
dereference will occur in the following code.

Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Larry Finger <Larry.Finger@...inger.net>
---
 drivers/staging/r8188eu/core/rtw_cmd.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/r8188eu/core/rtw_cmd.c b/drivers/staging/r8188eu/core/rtw_cmd.c
index c3a9051ca10c..238ae79f4141 100644
--- a/drivers/staging/r8188eu/core/rtw_cmd.c
+++ b/drivers/staging/r8188eu/core/rtw_cmd.c
@@ -1908,8 +1908,12 @@ static void c2h_wk_callback(struct work_struct *work)
 			c2h_evt = kmalloc(16, GFP_KERNEL);
 			if (c2h_evt) {
 				/* This C2H event is not read, read & clear now */
-				if (c2h_evt_read(adapter, (u8 *)c2h_evt) != _SUCCESS)
+				if (c2h_evt_read(adapter, (u8 *)c2h_evt) != _SUCCESS) {
+					kfree(c2h_evt);
 					continue;
+				}
+			} else {
+				return;
 			}
 		}
 
-- 
2.32.0