linux-kernel - Re: [PATCH v2 2/2] staging: r8188eu: fix potential memory leak in _rtw_init_xmit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 31 Mar 2022 14:23:12 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     xkernel.wang@...mail.com
Cc:     gregkh@...uxfoundation.org, Larry.Finger@...inger.net,
        phil@...lpotter.co.uk, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/2] staging: r8188eu: fix potential memory leak in
 _rtw_init_xmit_priv()

On Thu, Mar 31, 2022 at 06:58:16PM +0800, xkernel.wang@...mail.com wrote:
> +free_xmit_extbuf:
> +	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmit_extbuf;
> +	while (i-- > 0) {
> +		rtw_os_xmit_resource_free(padapter, pxmitbuf, (max_xmit_extbuf_size + XMITBUF_ALIGN_SZ));
> +		pxmitbuf++;
> +	}
> +	vfree(pxmitpriv->pallocated_xmit_extbuf);
> +	i = NR_XMITBUFF;
> +free_xmitbuf:
> +	pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
> +	while (i-- > 0) {
> +		rtw_os_xmit_resource_free(padapter, pxmitbuf, (MAX_XMITBUF_SZ + XMITBUF_ALIGN_SZ));
> +		pxmitbuf++;
> +	}

This works...  Presumably, it applies to staging-next even though it
doesn't apply to linux-next.  So:

Reviewed-by: Dan Carpenter <dan.carpenter@...cle.com>

In an ideal world, pxmitpriv->pxmitbuf would be declared as an array of
struct instead of an array of u8.  That would make it much simpler
because we could do

free_xmit_extbuf:
	while (--i >= 0)
		rtw_os_xmit_resource_free(pxmitpriv->pxmit_extbuf[i]);
	vfree(pxmitpriv->pxmit_extbuf);
	i = NR_XMITBUFF;
free_xmitbuf:
	while (--i >= 0)
		rtw_os_xmit_resource_free(pxmitpriv->pxmitbuf[i]);

regards,
dan carpenter