Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 31 Aug 2021 11:47:35 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     "F.A.Sulaiman" <asha.16@itfac.mrt.ac.lk>
Cc:     gregkh@linuxfoundation.org, devel@driverdev.osuosl.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] staging: rtl8723bs: fix memory leak error
Message-ID: <20210831084735.GL12231@kadam>
References: <20210830193355.11338-1-asha.16@itfac.mrt.ac.lk>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210830193355.11338-1-asha.16@itfac.mrt.ac.lk>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?7itHMNCxh/KVNY6SuZarRCbIIV0Cvz86eN54oeto2choGXbbU1xsDx8nrghd?=
 =?us-ascii?Q?4QFBEDZHO80I77Dg5Q0cCmKuIBS7Gtu5mdL1e8/i73fjCesZxjdJwvwRl/p8?=
 =?us-ascii?Q?Wf+wRLwtw09d10M5ewI67G7iT0AKaRCSxYJcq2ameE28jNdHDfi1fOmTEOod?=
 =?us-ascii?Q?psjqROuYOQWkx36qBZUs3UMQBmArob4LzRLy0GN36aHB4DiZ+SAJ0AABHR5B?=
 =?us-ascii?Q?s9rimR7MaygICwiYKayyrdXaUTke/GpV3cB6QESNFBXkP1R6MnlgF0C4ESM0?=
 =?us-ascii?Q?7OoVvJpw4xNQ0UddCrWkBJytviTqRw3Pv5SAOOb+dv/rDcg0T4dtLTYQToLd?=
 =?us-ascii?Q?v4x0jJqQG/zRmgwUzr/RJAM02H/1jGXMPEKyhITvh36Yc5PGJbMZhGGGw/8n?=
 =?us-ascii?Q?+oIAVrSp1M2qVgFmkGnp9S3BjJ4TICrdOiEnZet3+EuNnkfXZ5jtkDJ8VB4K?=
 =?us-ascii?Q?z9nt0q+kqCfV+F/jl732hW3/7T8Sm/Kz0Vk7/483uISjgZde5IJK6FfhbyFG?=
 =?us-ascii?Q?zRwicNMGfCs/KsfygtfozEobwuMqJiOK8HLX39wIby1fWp56WhmJa76MB1U5?=
 =?us-ascii?Q?bKSg8gp/5Nk9qaBirbKs02Vi8ZnL2ifqRBUP7RYLYUpwxt6RmB+Dwt+deE8u?=
 =?us-ascii?Q?KkBC3D7Sr7a7KVgNhAtxUzcWDvMqNKzrBbcoLPcrwy/XHXBgmxhcReoGDiM8?=
 =?us-ascii?Q?GiFHAwPOZ9VS7PqgXGPX9oiR/f4daPYeRgZDCRV/ChE0i4E1gKr3P2jUzosf?=
 =?us-ascii?Q?gktD/zXijG93Z5I5jeSrwlCPKez3NJnrRHDVjxhPLI2s0wR3tYqBaGyA6ShH?=
 =?us-ascii?Q?GFbsgGTTac2/OrWgsJNFgBMp7F+dZy9+YmFlrPhN6mwZW5nA/gellcPLET/K?=
 =?us-ascii?Q?R65N1dU7GgPgVBEuZUko4qdQPdI3ebd0RzxtoO2YOvnsD/6qGisz9JTjq6qN?=
 =?us-ascii?Q?njNDhJNvO2lr9m7dw1zabus1mZyeeLBZ44vW6jzMtIvb4Ab0PuBVykC6IQnE?=
 =?us-ascii?Q?Y+fhFDZx+aTUyQwpX+d23XLuae+jrqE3cvn+N8NDr6kqiGo5G58UZxYrtapu?=
 =?us-ascii?Q?05iWKDqY658WH8h+p+L2h7Taf4p57q2HMW+zZMR3XhR/CSUAbfIxI0EPVQ+8?=
 =?us-ascii?Q?CkmPZVMmA4Ett6hxciZD4qSxDe4e4QBmj8jebl/73tURdX9Cv0ja9RMrDS8i?=
 =?us-ascii?Q?1tYqtvdyL6kNYC6argGl10ZzleroYfJ6sCqRqq73y+duuCl5M2+gisip11FA?=
 =?us-ascii?Q?mxF5MkuGJuSjvyVD1Ub2dNfQJHDNbJxMuFBMeV9Fuuj3hGyPSUXtaEZoPmBG?=
 =?us-ascii?Q?VSrCWZMljXjbAKKYxpcSFZni?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e464b425-52ab-4fd8-0428-08d96c5c04cb
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2021 08:47:53.0975
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: cidy6/UKY08FCqOvOOtAs4M2CSAwZUrhxpUQVXguLbZcN56RPPRMRT9XuFAwKc8Nlz7umTCW1b8YeHDBtvkPlEI0XY3EMJNNIrSqJjfRQE4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO6PR10MB5569
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10092 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 phishscore=0 suspectscore=0
 adultscore=0 mlxscore=0 mlxlogscore=999 malwarescore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000
 definitions=main-2108310049
X-Proofpoint-GUID: T28Wl1t6UDfQfV4CTpKzVeZG-PF2xLlK
X-Proofpoint-ORIG-GUID: T28Wl1t6UDfQfV4CTpKzVeZG-PF2xLlK
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Aug 31, 2021 at 01:03:55AM +0530, F.A.Sulaiman wrote:
> Smatch reported memory leak bug in rtl8723b_FirmwareDownload function. 
> The problem is pFirmware memory is not released in release_fw1. 
> Instead of redirecting to release_fw1 we can turn it into exit 
> and free the memory.
> 
> Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk>
> ---
>  drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
> index de8caa6cd418..b59c2aa3a9d8 100644
> --- a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
> +++ b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
> @@ -436,7 +436,7 @@ s32 rtl8723b_FirmwareDownload(struct adapter *padapter, bool  bUsedWoWLANFw)
>  	if (pFirmware->fw_length > FW_8723B_SIZE) {
>  		rtStatus = _FAIL;
>  		DBG_871X_LEVEL(_drv_emerg_, "Firmware size:%u exceed %u\n", pFirmware->fw_length, FW_8723B_SIZE);
> -		goto release_fw1;
> +		goto exit;
>  	}

The current tree doesn't have DBG_871X_LEVEL() so you must be working
against something old.  You need to work against linux-next or staging
next.

Your patch fixes a bug, but it would be better to just re-write the
error handling for this function.  There is another bug that a bunch
of error paths don't call release_firmware(fw).  Use the "Free the Last
Thing" method.

	pFirmware = kzalloc(sizeof(struct rt_firmware), GFP_KERNEL);
	if (!pFirmware)
		return _FAIL;

The last thing we allocated is "pFirmware" so free that if we have an
error.

	pBTFirmware = kzalloc(sizeof(struct rt_firmware), GFP_KERNEL);
	if (!pBTFirmware) {
		rtStatus = _FAIL;
		goto free_firmware;
	}

Now the last thing is pBTFirmware.

	rtStatus = request_firmware(&fw, fwfilepath, device);
	if (rtStatus) {
		rtStatus = _FAIL;
		goto free_bt_firmware;
	}

Now the last thing is "fw".  But this is a bit tricky because we're
going to release it as soon as possible and not wait until the end of
the function.  There isn't a reason for this...  We can change that or
keep it as-is.  If we keep it as is, then the we'll just call
release_firmware(fw); before the goto free_bt_firmware;  The current
code leaks fw on a bunch of error paths.

	pFirmware->fw_buffer_sz = kmemdup(fw->data, fw->size, GFP_KERNEL);
	if (!pFirmware->fw_buffer_sz) {
		rtStatus = _FAIL;
		release_firmware(fw);
		goto free_bt_firmware;
	}

Or:

	pFirmware->fw_buffer_sz = kmemdup(fw->data, fw->size, GFP_KERNEL);
	if (!pFirmware->fw_buffer_sz) {
		rtStatus = _FAIL;
		goto release_fw;
	}

Now the last thing is pFirmware->fw_buffer_sz.  Etc.

Then at the end it's just:

free_fw_buffer:
        kfree(pFirmware->fw_buffer_sz);
release_fw:
	release_firmware(fw);
free_bt_firmware:
	kfree(pBTFirmware);
free_firmware:
        kfree(pFirmware);

        return rtStatus;
}

regards,
dan carpenter