linux-kernel - Re: [External] : Re: [PATCH 1/4] staging: rtl8723bs: fix firmware memory leak on error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <cf4400d9-2ea1-4bee-997e-94e27abe4166@oracle.com>
Date: Thu, 18 Dec 2025 09:00:27 -0800
From: samasth.norway.ananda@...cle.com
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: gregkh@...uxfoundation.org, linux-staging@...ts.linux.dev,
        linux-kernel@...r.kernel.org
Subject: Re: [External] : Re: [PATCH 1/4] staging: rtl8723bs: fix firmware
 memory leak on error path



On 12/17/25 11:14 PM, Dan Carpenter wrote:
> On Wed, Dec 17, 2025 at 05:14:11PM -0800, Samasth Norway Ananda wrote:
>> Fix memory leak where firmware is not released on error paths in
>> rtl8723b_FirmwareDownload().
>>
>> After successfully calling request_firmware(), if the firmware size
>> check fails or if kmemdup() fails, the code jumps to the exit label
>> without calling release_firmware(), causing a memory leak.
>>
>> Add a release_fw label to properly free the firmware in these er:qror
>> cases. Also add an error message when firmware size exceeds the limit to
>> help with debugging.
>>
>> Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@...cle.com>
>> ---
>>   drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 10 ++++++++--
>>   1 file changed, 8 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
>> index 57c83f332e74..0eae624a36f0 100644
>> --- a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
>> +++ b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
>> @@ -345,14 +345,16 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
>>   	}
>>   
>>   	if (fw->size > FW_8723B_SIZE) {
>> +		pr_err("Firmware size exceed, max: %d, actual: %zu\n",
>> +		       FW_8723B_SIZE, fw->size);
>>   		rtStatus = _FAIL;
>> -		goto exit;
>> +		goto release_fw;
>>   	}
>>   
>>   	pFirmware->fw_buffer_sz = kmemdup(fw->data, fw->size, GFP_KERNEL);
>>   	if (!pFirmware->fw_buffer_sz) {
>>   		rtStatus = _FAIL;
>> -		goto exit;
>> +		goto release_fw;
>>   	}
>>   
>>   	pFirmware->fw_length = fw->size;
>> @@ -415,6 +417,10 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
>>   		goto fwdl_stat;
>>   
>>   fwdl_stat:
>> +	goto exit;
> 
> What's the point of this nonsense label the just does another goto?

Thanks for the review Dan.
The intermediate label that just does "goto exit" is unnecessary. I will 
rework patch 1 to call release_firmware() directly in each error path 
instead of using an extra label.

regards,
Samasth.

> 
> regards,
> dan carpenter
> 
>> +
>> +release_fw:
>> +	release_firmware(fw);
>>   
>>   exit:
>>   	kfree(pFirmware->fw_buffer_sz);
>> -- 
>> 2.50.1
>>