Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CAFSR4cvhDYCYAKqvwe0Gr0St=X=8woZ=vve0-ZEPVXj9=1DwVA@mail.gmail.com>
In-Reply-To: <CAFSR4cvhDYCYAKqvwe0Gr0St=X=8woZ=vve0-ZEPVXj9=1DwVA@mail.gmail.com>
From:   Dongyang Zhan <zdyzztq@gmail.com>
Date:   Thu, 14 May 2020 12:02:21 +0800
Message-ID: <CAFSR4cuoYoM4vN-dhte=Sr56NqkL3X-sCmUDX91z689d1SrQpA@mail.gmail.com>
Subject: Fwd: Potential memory leak bug in mwifiex_init_rxq_ring()
To:     linux-wireless@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

---------- Forwarded message ---------
=E5=8F=91=E4=BB=B6=E4=BA=BA=EF=BC=9A Dongyang Zhan <zdyzztq@gmail.com>
Date: 2020=E5=B9=B45=E6=9C=883=E6=97=A5=E5=91=A8=E6=97=A5 =E4=B8=8B=E5=8D=
=882:16
Subject: Potential memory leak bug in mwifiex_init_rxq_ring()
To: <akarwar@marvell.com>
Cc: <linux-wireless@vger.kernel.org>


Hi,

I am a security researcher. I found a potential bug in
/drivers/net/wireless/marvell/mwifiex/pcie.c. I hope you can help me
to confirm it.

Potential memory leak in mwifiex_init_rxq_ring()
(/drivers/net/wireless/marvell/mwifiex/pcie.c) when triggering
mwifiex_map_pci_memory() fails.

Source Code:
skb =3D mwifiex_alloc_dma_align_buf(MWIFIEX_RX_DATA_BUF_SIZE,
 GFP_KERNEL);
if (!skb) {
mwifiex_dbg(adapter, ERROR,
   "Unable to allocate skb for RX ring.\n");
kfree(card->rxbd_ring_vbase);
return -ENOMEM;
}

if (mwifiex_map_pci_memory(adapter, skb,
  MWIFIEX_RX_DATA_BUF_SIZE,
  PCI_DMA_FROMDEVICE))
return -1;//skb is not released

...
}

Thank you.