Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <e33356c3b654db03030d371e38f02c6019e9c1a7.camel@sipsolutions.net>
Subject: Re: [PATCH v2] wifi: mac80211: fix memory leak in
 ieee80211_register_hw()
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Zhengchao Shao <shaozhengchao@huawei.com>,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com
Cc:     sara.sharon@intel.com, luciano.coelho@intel.com,
        weiyongjun1@huawei.com, yuehaibing@huawei.com
Date:   Wed, 18 Jan 2023 10:45:24 +0100
In-Reply-To: <20221202043838.2324539-1-shaozhengchao@huawei.com>
References: <20221202043838.2324539-1-shaozhengchao@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.46.3 (3.46.3-1.fc37) 
MIME-Version: 1.0
Precedence: bulk

On Fri, 2022-12-02 at 12:38 +0800, Zhengchao Shao wrote:
>=20
> --- a/net/mac80211/main.c
> +++ b/net/mac80211/main.c
> @@ -1326,6 +1326,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
>  					      hw->rate_control_algorithm);
>  	rtnl_unlock();
>  	if (result < 0) {
> +		ieee80211_txq_teardown_flows(local);
>  		wiphy_debug(local->hw.wiphy,
>  			    "Failed to initialize rate control algorithm\n");
>  		goto fail_rate;
> @@ -1364,6 +1365,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
> =20
>  		sband =3D kmemdup(sband, sizeof(*sband), GFP_KERNEL);
>  		if (!sband) {
> +			ieee80211_txq_teardown_flows(local);
>  			result =3D -ENOMEM;
>  			goto fail_rate;
>  		}

I don't understand - we have a fail_rate label here where we free
everything.

What if we get to fail_wiphy_register, don't we leak it in the same way?

johannes