netdev - Re: [PATCH net-next] mac80211_hwsim: fix memory leak in hwsim_new_radio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c727aa9936c597d8297ab5659eba4e934f59349f.camel@microchip.com>
Date: Mon, 15 May 2023 10:30:52 +0200
From: Steen Hegelund <steen.hegelund@...rochip.com>
To: Zhengchao Shao <shaozhengchao@...wei.com>,
	<linux-wireless@...r.kernel.org>, <netdev@...r.kernel.org>,
	<johannes@...solutions.net>, <kvalo@...nel.org>, <davem@...emloft.net>,
	<edumazet@...gle.com>, <kuba@...nel.org>, <pabeni@...hat.com>
CC: <weiyongjun1@...wei.com>, <yuehaibing@...wei.com>,
	<syzbot+904ce6fbb38532d9795c@...kaller.appspotmail.com>
Subject: Re: [PATCH net-next] mac80211_hwsim: fix memory leak in
 hwsim_new_radio_nl

Hi Shao,

On Mon, 2023-05-15 at 11:47 +0800, Zhengchao Shao wrote:
> [You don't often get email from shaozhengchao@...wei.com. Learn why this is
> important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the
> content is safe
> 
> When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources
> applied for by pmsr_capa are not released. Add release processing to the
> incorrect path.
> 
> Fixes: 92d13386ec55 ("mac80211_hwsim: add PMSR capability support")
> Reported-by: syzbot+904ce6fbb38532d9795c@...kaller.appspotmail.com
> Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
> ---
>  drivers/net/wireless/virtual/mac80211_hwsim.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c
> b/drivers/net/wireless/virtual/mac80211_hwsim.c
> index 9a8faaf4c6b6..6a50858a5645 100644
> --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
> +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
> @@ -5965,8 +5965,10 @@ static int hwsim_new_radio_nl(struct sk_buff *msg,
> struct genl_info *info)
>                         goto out_free;
>                 }
>                 ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT],
> pmsr_capa, info);
> -               if (ret)
> +               if (ret) {
> +                       kfree(pmsr_capa);

This should not be needed, see below.

>                         goto out_free;
> +               }
>                 param.pmsr_capa = pmsr_capa;


Why don't you just move this line up before the parse_pmsr_capa as there is
already a kfree(param.pmsr_capa) under the out_free label?

>         }
> 
> --
> 2.34.1
> 
> 

BR
Steen