Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg KH <greg@kroah.com>
To: Nguyen Dinh Phi <phind.uet@gmail.com>
Cc: johannes@sipsolutions.net, davem@davemloft.net, kuba@kernel.org,
	netdev@vger.kernel.org, linux-wireless@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	linux-kernel-mentees@lists.linuxfoundation.org
Subject: Re: [PATCH V2] cfg80211: Fix possible memory leak in function cfg80211_bss_update
Date: Thu, 29 Jul 2021 12:34:22 +0200	[thread overview]
Message-ID: <YQKELjKuAQsjmpLY@kroah.com> (raw)
In-Reply-To: <20210628132334.851095-1-phind.uet@gmail.com>

On Mon, Jun 28, 2021 at 09:23:34PM +0800, Nguyen Dinh Phi wrote:
> When we exceed the limit of BSS entries, this function will free the
> new entry, however, at this time, it is the last door to access the
> inputed ies, so these ies will be unreferenced objects and cause memory
> leak.
> Therefore we should free its ies before deallocating the new entry, beside
> of dropping it from hidden_list.
> 
> Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
> ---
> V2:	- Add subsystem to the subject line.
> 	- Use bss_ref_put function for better clean-up dynamically allocated
> 	cfg80211_internal_bss objects. It helps to clean relative hidden_bss.
> 
>  net/wireless/scan.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/net/wireless/scan.c b/net/wireless/scan.c
> index f03c7ac8e184..7897b1478c3c 100644
> --- a/net/wireless/scan.c
> +++ b/net/wireless/scan.c
> @@ -1754,16 +1754,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
>  			 * be grouped with this beacon for updates ...
>  			 */
>  			if (!cfg80211_combine_bsses(rdev, new)) {
> -				kfree(new);
> +				bss_ref_put(rdev, new);
>  				goto drop;
>  			}
>  		}
> 
>  		if (rdev->bss_entries >= bss_entries_limit &&
>  		    !cfg80211_bss_expire_oldest(rdev)) {
> -			if (!list_empty(&new->hidden_list))
> -				list_del(&new->hidden_list);
> -			kfree(new);
> +			bss_ref_put(rdev, new);
>  			goto drop;
>  		}
> 
> --
> 2.25.1

Did this change get lost somewhere?

thanks,

greg k-h

  reply	other threads:[~2021-07-29 10:34 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-28 13:23 Nguyen Dinh Phi
2021-07-29 10:34 ` Greg KH [this message]
2021-07-31  7:53   ` Kalle Valo
2021-07-31  8:02     ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YQKELjKuAQsjmpLY@kroah.com \
    --to=greg@kroah.com \
    --cc=davem@davemloft.net \
    --cc=johannes@sipsolutions.net \
    --cc=kuba@kernel.org \
    --cc=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=phind.uet@gmail.com \
    --subject='Re: [PATCH V2] cfg80211: Fix possible memory leak in function cfg80211_bss_update' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox