Re: [PATCH] ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others
From: Alexander Aring <alex.aring@gmail.com>
Date: 2021-06-12 12:39:59
Also in:
lkml
Hi, On Thu, 10 Jun 2021 at 21:58, Dongliang Mu [off-list ref] wrote:
quoted hunk ↗ jump to hunk
In hwsim_subscribe_all_others, the error handling code performs incorrectly if the second hwsim_alloc_edge fails. When this issue occurs, it goes to sub_fail, without cleaning the edges allocated before. Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") Signed-off-by: Dongliang Mu <redacted> --- drivers/net/ieee802154/mac802154_hwsim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c index da9135231c07..366eaae3550a 100644 --- a/drivers/net/ieee802154/mac802154_hwsim.c +++ b/drivers/net/ieee802154/mac802154_hwsim.c@@ -715,6 +715,8 @@ static int hwsim_subscribe_all_others(struct hwsim_phy *phy) return 0; +sub_fail: + hwsim_edge_unsubscribe_me(phy); me_fail: rcu_read_lock(); list_for_each_entry_rcu(e, &phy->edges, list) {@@ -722,8 +724,6 @@ static int hwsim_subscribe_all_others(struct hwsim_phy *phy) hwsim_free_edge(e); } rcu_read_unlock(); -sub_fail:
this goto needs to be removed and all goto cases need to end in me_fail (better named to be fail only). In an error case both loops need to be iterated again to cleanup. - Alex