| Message ID | 20230515092227.2691437-1-shaozhengchao@huawei.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Johannes Berg |
| Headers | show |
| Series | [net-next,v2] mac80211_hwsim: fix memory leak in hwsim_new_radio_nl | expand |
Zhengchao Shao <shaozhengchao@huawei.com> writes: > When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources > applied for by pmsr_capa are not released. Add release processing to the > incorrect path. > > Fixes: 92d13386ec55 ("mac80211_hwsim: add PMSR capability support") > Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com > Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> > --- > v2: move the value assigned to pmsr_capa before parse_pmsr_capa > --- > drivers/net/wireless/virtual/mac80211_hwsim.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) drivers/net/wireless changes go to wireless-next, not net-next. But no need to resend because of this.
On 2023/5/15 19:01, Kalle Valo wrote: > Zhengchao Shao <shaozhengchao@huawei.com> writes: > >> When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources >> applied for by pmsr_capa are not released. Add release processing to the >> incorrect path. >> >> Fixes: 92d13386ec55 ("mac80211_hwsim: add PMSR capability support") >> Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com >> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> >> --- >> v2: move the value assigned to pmsr_capa before parse_pmsr_capa >> --- >> drivers/net/wireless/virtual/mac80211_hwsim.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) > > drivers/net/wireless changes go to wireless-next, not net-next. But no > need to resend because of this. > Thank you for the reminder. I will pay attention next time. Zhengchao Shao
On Mon, May 15, 2023 at 05:22:27PM +0800, Zhengchao Shao wrote: > When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources > applied for by pmsr_capa are not released. Add release processing to the > incorrect path. > > Fixes: 92d13386ec55 ("mac80211_hwsim: add PMSR capability support") > Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com > Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> > --- > v2: move the value assigned to pmsr_capa before parse_pmsr_capa Reviewed-by: Simon Horman <simon.horman@corigine.com>
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c index 9a8faaf4c6b6..89c7a1420381 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c @@ -5964,10 +5964,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) ret = -ENOMEM; goto out_free; } + param.pmsr_capa = pmsr_capa; + ret = parse_pmsr_capa(info->attrs[HWSIM_ATTR_PMSR_SUPPORT], pmsr_capa, info); if (ret) goto out_free; - param.pmsr_capa = pmsr_capa; } ret = mac80211_hwsim_new_radio(info, ¶m);
When parse_pmsr_capa failed in hwsim_new_radio_nl, the memory resources applied for by pmsr_capa are not released. Add release processing to the incorrect path. Fixes: 92d13386ec55 ("mac80211_hwsim: add PMSR capability support") Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com> --- v2: move the value assigned to pmsr_capa before parse_pmsr_capa --- drivers/net/wireless/virtual/mac80211_hwsim.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)