From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF1AAC5479D for ; Tue, 3 Jan 2023 21:05:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233708AbjACVFE (ORCPT ); Tue, 3 Jan 2023 16:05:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44980 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233719AbjACVEg (ORCPT ); Tue, 3 Jan 2023 16:04:36 -0500 Received: from mail.toke.dk (mail.toke.dk [IPv6:2a0c:4d80:42:2001::664]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3265E140D6; Tue, 3 Jan 2023 13:04:35 -0800 (PST) From: Toke =?utf-8?Q?H=C3=B8iland-J=C3=B8rgensen?= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=toke.dk; s=20161023; t=1672779873; bh=qyIjFinFityRMegIbRBQ0PW0rEHzPyNxjyFmnFCju74=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=OqJ6s5aS9ol7+Z3Q1KJY0H6pLRFHCicC55Ndp9L7dz0ccrvVv+yvwtl0slItF5wl7 90JQXzIirW2+kOpDZZJk5oHkm/50naHmn+RyGoZICaVUCxZuz8uTxtQVR9feh9Np8Q hSwSqn908yv5toaWdIEul5I+0kL4052W6F1z57iDi1zN38/JIRz70iMw2N8H2CAGCr athRsV2I1k1wLQ3OwrvI46+f+eddhiBo8kPNR5v3MS1qofBhEpQqatQeX/IfCZ5tYC doMxqzcd7gj3HF3+i+nwbDkQMfIRA2MBcFWm6RcFuB+tIYg0I+HZ7tU0V8vNG6Ka7Z 7fIB4iw3xdOyA== To: Fedor Pchelkin , Kalle Valo Cc: Fedor Pchelkin , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Sujith , "John W. Linville" , Vasanthakumar Thiagarajan , Senthil Balasubramanian , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org, syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com, syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com Subject: Re: [PATCH v2] wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function In-Reply-To: <20230103143202.274163-1-pchelkin@ispras.ru> References: <20230103143202.274163-1-pchelkin@ispras.ru> Date: Tue, 03 Jan 2023 22:04:31 +0100 X-Clacks-Overhead: GNU Terry Pratchett Message-ID: <87358r49eo.fsf@toke.dk> MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Fedor Pchelkin writes: > It is stated that ath9k_htc_rx_msg() either frees the provided skb or > passes its management to another callback function. However, the skb is > not freed in case there is no another callback function, and Syzkaller was > able to cause a memory leak. Also minor comment fix. > > Found by Linux Verification Center (linuxtesting.org) with Syzkaller. > > Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") > Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com > Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com > Signed-off-by: Fedor Pchelkin > Signed-off-by: Alexey Khoroshilov > --- > v1->v2: added Reported-by tag > > drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c > index ca05b07a45e6..7d5041eb5f29 100644 > --- a/drivers/net/wireless/ath/ath9k/htc_hst.c > +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c > @@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle, > * HTC Messages are handled directly here and the obtained SKB > * is freed. > * > - * Service messages (Data, WMI) passed to the corresponding > + * Service messages (Data, WMI) are passed to the corresponding > * endpoint RX handlers, which have to free the SKB. > */ > void ath9k_htc_rx_msg(struct htc_target *htc_handle, > @@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, > if (endpoint->ep_callbacks.rx) > endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv, > skb, epid); > + else > + kfree_skb(skb); Shouldn't this be 'goto invalid' like all the other error paths in that function? -Toke