Messages in this thread Patch in this message | | | From | "Fabio M. De Francesco" <> | Subject | Re: [syzbot] memory leak in cfg80211_inform_single_bss_frame_data | Date | Tue, 26 Oct 2021 11:27:31 +0200 |
| |
On Tuesday, October 26, 2021 12:33:23 AM CEST syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 87066fdd2e30 Revert "mm/secretmem: use refcount_t instead .. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=16b55554b00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=d25eeb482b0f99b > dashboard link: https://syzkaller.appspot.com/bug? extid=7a942657a255a9d9b18a > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=171cf464b00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1396b19f300000 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com > > BUG: memory leak > unreferenced object 0xffff88810f3c7980 (size 96):
Let's try the attached diff.
Fabiodiff --git a/net/wireless/scan.c b/net/wireless/scan.c index 11c68b159324..e84855ea4075 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2380,7 +2380,7 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy, capability = le16_to_cpu(mgmt->u.probe_resp.capab_info); } - ies = kzalloc(sizeof(*ies) + ielen, gfp); + ies = kzalloc(sizeof(cfg80211_bss_ies) + ielen, gfp); if (!ies) return NULL; ies->len = ielen; | |