Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
To:     davem@davemloft.net, johannes@sipsolutions.net, kuba@kernel.org,
        linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org,
        mudongliangabcd@gmail.com, netdev@vger.kernel.org,
        phind.uet@gmail.com, syzkaller-bugs@googlegroups.com
Cc:     syzbot <syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com>
Subject: Re: [syzbot] memory leak in cfg80211_inform_single_bss_frame_data
Date:   Tue, 26 Oct 2021 11:27:31 +0200
Message-ID: <2678912.i2LAJy1QmT@localhost.localdomain>
In-Reply-To: <000000000000e1063f05cf34f2a8@google.com>
References: <000000000000e1063f05cf34f2a8@google.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="nextPart327050664.krEj5IxTLE"
Content-Transfer-Encoding: 7Bit
Precedence: bulk

This is a multi-part message in MIME format.

--nextPart327050664.krEj5IxTLE
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="UTF-8"

On Tuesday, October 26, 2021 12:33:23 AM CEST syzbot wrote:
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    87066fdd2e30 Revert "mm/secretmem: use refcount_t instead 
..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16b55554b00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d25eeb482b0f99b
> dashboard link: https://syzkaller.appspot.com/bug?
extid=7a942657a255a9d9b18a
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils 
for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=171cf464b00000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1396b19f300000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the 
commit:
> Reported-by: syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com
> 
> BUG: memory leak
> unreferenced object 0xffff88810f3c7980 (size 96):

Let's try the attached diff.

Fabio
--nextPart327050664.krEj5IxTLE
Content-Disposition: attachment; filename="scan_c_diff"
Content-Transfer-Encoding: 7Bit
Content-Type: text/x-patch; charset="UTF-8"; name="scan_c_diff"

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 11c68b159324..e84855ea4075 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2380,7 +2380,7 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
 		capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 	}
 
-	ies = kzalloc(sizeof(*ies) + ielen, gfp);
+	ies = kzalloc(sizeof(cfg80211_bss_ies) + ielen, gfp);
 	if (!ies)
 		return NULL;
 	ies->len = ielen;

--nextPart327050664.krEj5IxTLE--