linux-kernel - Re: Re: [PATCH] [v2] ethernet: atheros: fix a memleak in atl1e_setup_ring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <632c5358.35eae.18c686e98f2.Coremail.alexious@zju.edu.cn>
Date:   Thu, 14 Dec 2023 21:05:27 +0800 (GMT+08:00)
From:   alexious@....edu.cn
To:     "Jakub Kicinski" <kuba@...nel.org>
Cc:     "Chris Snook" <chris.snook@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        "Eric Dumazet" <edumazet@...gle.com>,
        "Paolo Abeni" <pabeni@...hat.com>,
        "Simon Horman" <horms@...nel.org>,
        "Yuanjun Gong" <ruc_gongyuanjun@....com>,
        "Jie Yang" <jie.yang@...eros.com>,
        "Jeff Garzik" <jgarzik@...hat.com>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: Re: [PATCH] [v2] ethernet: atheros: fix a memleak in
 atl1e_setup_ring_resources


> On Fri,  8 Dec 2023 16:23:14 +0800 Zhipeng Lu wrote:
> > v2: Setting tx_ring->tx_buffer to NULL after free.
> 
> Having closer look at this driver  - it tries to free both on close and
> remove, so seems like we do indeed have to NULL-out the pointer, sigh.
> 
> > diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
> > index 5935be190b9e..1bffe77439ac 100644
> > --- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
> > +++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
> > @@ -866,6 +866,8 @@ static int atl1e_setup_ring_resources(struct atl1e_adapter *adapter)
> >  		netdev_err(adapter->netdev, "offset(%d) > ring size(%d) !!\n",
> >  			   offset, adapter->ring_size);
> >  		err = -1;
> > +		kfree(tx_ring->tx_buffer);
> > +		tx_ring->tx_buffer = NULL;
> >  		goto failed;
> 
> Please add a new jump target, tho, and move the freeing there.
> There's a small chance someone will add more code to this function
> and it will need to copy / paste this unwind.
> -- 

Thank you for your advice, I've send a v3 version of this patch.