linux-kernel - Re: [PATCH 1/4] staging: rtl8723bs: fix firmware memory leak on error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aUOp5rEWwjOp6-nU@stanley.mountain>
Date: Thu, 18 Dec 2025 10:14:46 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Samasth Norway Ananda <samasth.norway.ananda@...cle.com>
Cc: gregkh@...uxfoundation.org, linux-staging@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/4] staging: rtl8723bs: fix firmware memory leak on
 error path

On Wed, Dec 17, 2025 at 05:14:11PM -0800, Samasth Norway Ananda wrote:
> Fix memory leak where firmware is not released on error paths in
> rtl8723b_FirmwareDownload().
> 
> After successfully calling request_firmware(), if the firmware size
> check fails or if kmemdup() fails, the code jumps to the exit label
> without calling release_firmware(), causing a memory leak.
> 
> Add a release_fw label to properly free the firmware in these er:qror
> cases. Also add an error message when firmware size exceeds the limit to
> help with debugging.
> 
> Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@...cle.com>
> ---
>  drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
> index 57c83f332e74..0eae624a36f0 100644
> --- a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
> +++ b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
> @@ -345,14 +345,16 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
>  	}
>  
>  	if (fw->size > FW_8723B_SIZE) {
> +		pr_err("Firmware size exceed, max: %d, actual: %zu\n",
> +		       FW_8723B_SIZE, fw->size);
>  		rtStatus = _FAIL;
> -		goto exit;
> +		goto release_fw;
>  	}
>  
>  	pFirmware->fw_buffer_sz = kmemdup(fw->data, fw->size, GFP_KERNEL);
>  	if (!pFirmware->fw_buffer_sz) {
>  		rtStatus = _FAIL;
> -		goto exit;
> +		goto release_fw;
>  	}
>  
>  	pFirmware->fw_length = fw->size;
> @@ -415,6 +417,10 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
>  		goto fwdl_stat;
>  
>  fwdl_stat:
> +	goto exit;

What's the point of this nonsense label the just does another goto?

regards,
dan carpenter

> +
> +release_fw:
> +	release_firmware(fw);
>  
>  exit:
>  	kfree(pFirmware->fw_buffer_sz);
> -- 
> 2.50.1
>