linux-kernel - [PATCH v2 net] sfc: fix potential memory leak in efx_mae_process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251023141844.25847-1-nihaal@cse.iitm.ac.in>
Date: Thu, 23 Oct 2025 19:48:42 +0530
From: Abdun Nihaal <nihaal@....iitm.ac.in>
To: ecree.xilinx@...il.com
Cc: Abdun Nihaal <nihaal@....iitm.ac.in>,
	andrew+netdev@...n.ch,
	davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	habetsm.xilinx@...il.com,
	alejandro.lucero-palau@....com,
	netdev@...r.kernel.org,
	linux-net-drivers@....com,
	linux-kernel@...r.kernel.org
Subject: [PATCH v2 net] sfc: fix potential memory leak in efx_mae_process_mport()

In efx_mae_enumerate_mports(), memory allocated for mae_mport_desc is
passed as a argument to efx_mae_process_mport(), but when the error path
in efx_mae_process_mport() gets executed, the memory allocated for desc
gets leaked.

Fix that by freeing the memory allocation before returning error.

Fixes: a6a15aca4207 ("sfc: enumerate mports in ef100")
Acked-by: Edward Cree <ecree.xilinx@...il.com>
Signed-off-by: Abdun Nihaal <nihaal@....iitm.ac.in>
---

v1->v2:
- Added a comment to tell that efx_mae_process_mport takes ownership of
   @desc, as suggested by Edward
- Also added Acked-by tag from Edward

Link to v1 patch:
https://patchwork.kernel.org/project/netdevbpf/patch/20251022163525.86362-1-nihaal@cse.iitm.ac.in/

 drivers/net/ethernet/sfc/mae.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/sfc/mae.c b/drivers/net/ethernet/sfc/mae.c
index 6fd0c1e9a7d5..7cfd9000f79d 100644
--- a/drivers/net/ethernet/sfc/mae.c
+++ b/drivers/net/ethernet/sfc/mae.c
@@ -1090,6 +1090,9 @@ void efx_mae_remove_mport(void *desc, void *arg)
 	kfree(mport);
 }
 
+/*
+ * Takes ownership of @desc, even if it returns an error
+ */
 static int efx_mae_process_mport(struct efx_nic *efx,
 				 struct mae_mport_desc *desc)
 {
@@ -1100,6 +1103,7 @@ static int efx_mae_process_mport(struct efx_nic *efx,
 	if (!IS_ERR_OR_NULL(mport)) {
 		netif_err(efx, drv, efx->net_dev,
 			  "mport with id %u does exist!!!\n", desc->mport_id);
+		kfree(desc);
 		return -EEXIST;
 	}
 
-- 
2.43.0