lkml.org 
[lkml]   [2021]   [Oct]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] memory leak in cfg80211_inform_single_bss_frame_data
Date
On Tuesday, October 26, 2021 12:33:23 AM CEST syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 87066fdd2e30 Revert "mm/secretmem: use refcount_t instead
..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16b55554b00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d25eeb482b0f99b
> dashboard link: https://syzkaller.appspot.com/bug?
extid=7a942657a255a9d9b18a
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils
for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=171cf464b00000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1396b19f300000
>
> IMPORTANT: if you fix the issue, please add the following tag to the
commit:
> Reported-by: syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff88810f3c7980 (size 96):

Let's try the attached diff.

Fabiodiff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 11c68b159324..e84855ea4075 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2380,7 +2380,7 @@ cfg80211_inform_single_bss_frame_data(struct wiphy *wiphy,
capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
}

- ies = kzalloc(sizeof(*ies) + ielen, gfp);
+ ies = kzalloc(sizeof(cfg80211_bss_ies) + ielen, gfp);
if (!ies)
return NULL;
ies->len = ielen;
\
 
 \ /
  Last update: 2021-10-26 11:28    [W:0.081 / U:0.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site