Re: [PATCH] genetlink: Prevent memory leak when krealloc fail

Florian Westphal
2023-11-18T12:02:53Z

Kamil Duljas <kamil.duljas@gmail.com> wrote:
> genl_allocate_reserve_groups() allocs new memory in while loop
> but if krealloc fail, the memory allocated by kzalloc is not freed.
> It seems allocated memory is unnecessary when the function
> returns -ENOMEM

Why should it be free'd? mc_groups is not a local variable.

> new_groups = krealloc(mc_groups, nlen,
> GFP_KERNEL);
> - if (!new_groups)
> + if (!new_groups) {
> + kfree(mc_groups);
> return -ENOMEM;
> + }

How did you test this? AFAICS this results in use-after-free for every
access to mc_groups after this error path is taken.

Existing code looks correct, we can't grow mc_groups and return an
error.