netdev - Re: [PATCH net-next] s390/ctcm: Fix double-kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aRs26yy7xkr3Ln54@horms.kernel.org>
Date: Mon, 17 Nov 2025 14:53:31 +0000
From: Simon Horman <horms@...nel.org>
To: Aswin Karuvally <aswin@...ux.ibm.com>
Cc: David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>,
	Andrew Lunn <andrew+netdev@...n.ch>, netdev@...r.kernel.org,
	linux-s390@...r.kernel.org, Heiko Carstens <hca@...ux.ibm.com>,
	Vasily Gorbik <gor@...ux.ibm.com>,
	Alexander Gordeev <agordeev@...ux.ibm.com>,
	Alexandra Winter <wintera@...ux.ibm.com>,
	Christian Borntraeger <borntraeger@...ux.ibm.com>,
	Sven Schnelle <svens@...ux.ibm.com>,
	Aleksei Nikiforov <aleksei.nikiforov@...ux.ibm.com>
Subject: Re: [PATCH net-next] s390/ctcm: Fix double-kfree

On Wed, Nov 12, 2025 at 07:27:24PM +0100, Aswin Karuvally wrote:
> From: Aleksei Nikiforov <aleksei.nikiforov@...ux.ibm.com>
> 
> The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally
> from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo.
> After that a call to function 'kfree' in function 'ctcmpc_unpack_skb'
> frees it again.
> 
> Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'.
> 
> Bug detected by the clang static analyzer.
> 
> Fixes: 0c0b20587b9f25a2 ("s390/ctcm: fix potential memory leak")
> Reviewed-by: Aswin Karuvally <aswin@...ux.ibm.com>
> Signed-off-by: Aleksei Nikiforov <aleksei.nikiforov@...ux.ibm.com>
> Signed-off-by: Aswin Karuvally <aswin@...ux.ibm.com>

Thanks,

I agree with this analysis.
And this change brings mpc_rcvd_sweep_req()
into line with other functions that ctcmpc_unpack_skb()
passes mpcginfo - they don't free it either.

Reviewed-by: Simon Horman <horms@...nel.org>

...