Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.37 as permitted sender) client-ip=23.128.96.37;
Date:   Sat, 18 Nov 2023 13:02:35 +0100
From:   Florian Westphal <fw@strlen.de>
To:     Kamil Duljas <kamil.duljas@gmail.com>
Cc:     Jakub Kicinski <kuba@kernel.org>,
        "David S . Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>, Jiri Pirko <jiri@resnulli.us>,
        Johannes Berg <johannes@sipsolutions.net>,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] genetlink: Prevent memory leak when krealloc fail
Message-ID: <20231118120235.GA30289@breakpoint.cc>
References: <20231118113357.1999-1-kamil.duljas@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20231118113357.1999-1-kamil.duljas@gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Precedence: bulk

Kamil Duljas <kamil.duljas@gmail.com> wrote:
> genl_allocate_reserve_groups() allocs new memory in while loop
> but if krealloc fail, the memory allocated by kzalloc is not freed.
> It seems allocated memory is unnecessary when the function
> returns -ENOMEM

Why should it be free'd?  mc_groups is not a local variable.

>  				new_groups = krealloc(mc_groups, nlen,
>  						      GFP_KERNEL);
> -				if (!new_groups)
> +				if (!new_groups) {
> +					kfree(mc_groups);
>  					return -ENOMEM;
> +				}

How did you test this?  AFAICS this results in use-after-free for every
access to mc_groups after this error path is taken.

Existing code looks correct, we can't grow mc_groups and return an
error.