[PATCH] nl80211: Potential memory leaks in reg.c

[PATCH] nl80211: Potential memory leaks in reg.c

[Ola Olsson]

The first leak occurs when entering the default case
in the switch for the initiator in set_regdom.
The second leaks a platform_device struct if the
platform registration in regulatory_init succeeds but
the sub sequent regulatory hint fails due to no memory.

Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com>
---
 net/wireless/reg.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2e8d6f3..06d050d 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -3029,6 +3029,7 @@ int set_regdom(const struct ieee80211_regdomain *rd,
 		break;
 	default:
 		WARN(1, "invalid initiator %d\n", lr->initiator);
+		kfree(rd);
 		return -EINVAL;
 	}
 
@@ -3221,8 +3222,10 @@ int __init regulatory_init(void)
 	/* We always try to get an update for the static regdomain */
 	err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
 	if (err) {
-		if (err == -ENOMEM)
+		if (err == -ENOMEM) {
+			platform_device_unregister(reg_pdev);
 			return err;
+		}
 		/*
 		 * N.B. kobject_uevent_env() can fail mainly for when we're out
 		 * memory which is handled and propagated appropriately above
-- 
1.7.9.5

Re: [PATCH] nl80211: Potential memory leaks in reg.c

[Johannes Berg]

On Sun, 2015-12-13 at 19:12 +0100, Ola Olsson wrote:
> The first leak occurs when entering the default case
> in the switch for the initiator in set_regdom.
> The second leaks a platform_device struct if the
> platform registration in regulatory_init succeeds but
> the sub sequent regulatory hint fails due to no memory.

Applied, thanks. How are you finding these?? They seems so obscure :)

johannes

Re: [PATCH] nl80211: Potential memory leaks in reg.c

[Ola Olsson]

I'm trying to learn how the code works so I'm reading through it line
by line. I have seen so many memory leaks in my days so I know where
to look ;)
They are indeed obscure since we need an error to actually trigger
them but I thought I might as well share the info when I found them.

On Tue, Dec 15, 2015 at 1:09 PM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> On Sun, 2015-12-13 at 19:12 +0100, Ola Olsson wrote:
>> The first leak occurs when entering the default case
>> in the switch for the initiator in set_regdom.
>> The second leaks a platform_device struct if the
>> platform registration in regulatory_init succeeds but
>> the sub sequent regulatory hint fails due to no memory.
>
> Applied, thanks. How are you finding these?? They seems so obscure :)
>
> johannes

Re: [PATCH] nl80211: Potential memory leaks in reg.c

[Johannes Berg]

On Tue, 2015-12-15 at 13:19 +0100, Ola Olsson wrote:
> I'm trying to learn how the code works so I'm reading through it line
> by line. I have seen so many memory leaks in my days so I know where
> to look ;)

Ok :)

> They are indeed obscure since we need an error to actually trigger
> them but I thought I might as well share the info when I found them.

Of course, the patches are very welcome!

I'm just surprised that none of the tools we (and others) typically run
found these, and thought perhaps you had a better tool than we do...
I guess it's called "brain" and we just don't use it right ;-)

johannes

Re: [PATCH] nl80211: Potential memory leaks in reg.c

[Ola Olsson]

> I'm just surprised that none of the tools we (and others) typically run
> found these, and thought perhaps you had a better tool than we do...
> I guess it's called "brain" and we just don't use it right ;-)

Hahaha, I doubt that is the case. :)