lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 22 Dec 2022 18:01:17 +0200 From: Kalle Valo <kvalo@...nel.org> To: Jianglei Nie <niejianglei2021@....com> Cc: aspriel@...il.com, franky.lin@...adcom.com, hante.meuleman@...adcom.com, davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, alsi@...g-olufsen.dk, rmk+kernel@...linux.org.uk, linus.walleij@...aro.org, marcan@...can.st, linux-wireless@...r.kernel.org, brcm80211-dev-list.pdl@...adcom.com, SHA-cyfmac-dev-list@...ineon.com, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] net: brcmfmac: fix potential resource leak in brcmf_usb_probe_phase2() Jianglei Nie <niejianglei2021@....com> writes: > brcmf_usb_probe_phase2() allocates resource for dev with brcmf_alloc(). > The related resource should be released when the function gets some error. > But when brcmf_attach() fails, relevant resource is not released, which > will lead to resource leak. > > Fix it by calling brcmf_free() when brcmf_attach() fails. > > Signed-off-by: Jianglei Nie <niejianglei2021@....com> > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c > index 85e18fb9c497..5d8c12b2c4d7 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c > @@ -1215,6 +1215,7 @@ static void brcmf_usb_probe_phase2(struct device *dev, int ret, > return; > error: > brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), ret); > + brcmf_free(devinfo->dev); > complete(&devinfo->dev_init_done); > device_release_driver(dev); > } This doesn't look right. Now we would call brfmf_free() even before brcmf_alloc() is called. -- https://patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Powered by blists - more mailing lists