Fwd: Potential memory leak bug in mwifiex_init_rxq_ring()

* Fwd: Potential memory leak bug in mwifiex_init_rxq_ring()
       [not found] <CAFSR4cvhDYCYAKqvwe0Gr0St=X=8woZ=vve0-ZEPVXj9=1DwVA@mail.gmail.com>
@ 2020-05-14  4:02 ` Dongyang Zhan
  0 siblings, 0 replies; only message in thread
From: Dongyang Zhan @ 2020-05-14  4:02 UTC (permalink / raw)
  To: linux-wireless

---------- Forwarded message ---------
发件人： Dongyang Zhan <zdyzztq@gmail.com>
Date: 2020年5月3日周日 下午2:16
Subject: Potential memory leak bug in mwifiex_init_rxq_ring()
To: <akarwar@marvell.com>
Cc: <linux-wireless@vger.kernel.org>

Hi,

I am a security researcher. I found a potential bug in
/drivers/net/wireless/marvell/mwifiex/pcie.c. I hope you can help me
to confirm it.

Potential memory leak in mwifiex_init_rxq_ring()
(/drivers/net/wireless/marvell/mwifiex/pcie.c) when triggering
mwifiex_map_pci_memory() fails.

Source Code:
skb = mwifiex_alloc_dma_align_buf(MWIFIEX_RX_DATA_BUF_SIZE,
 GFP_KERNEL);
if (!skb) {
mwifiex_dbg(adapter, ERROR,
   "Unable to allocate skb for RX ring.\n");
kfree(card->rxbd_ring_vbase);
return -ENOMEM;
}

if (mwifiex_map_pci_memory(adapter, skb,
  MWIFIEX_RX_DATA_BUF_SIZE,
  PCI_DMA_FROMDEVICE))
return -1;//skb is not released

...
}

Thank you.

^ permalink raw reply	[flat|nested] only message in thread