| Message ID | 20240202164213.1606145-1-jerome.pouiller@silabs.com |
|---|---|
| State | New |
| Headers | show |
| Series | wifi: wfx: fix memory leak when starting AP | expand |
Jérôme Pouiller <jerome.pouiller@silabs.com> wrote: > Kmemleak reported this error: > > unreferenced object 0xd73d1180 (size 184): > comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ > backtrace: > [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac > [<127bdd74>] __alloc_skb+0x144/0x170 > [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180 > [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] > [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] > [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx] > [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211] > [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211] > [<47bd8b68>] genl_rcv_msg+0x198/0x378 > [<453ef796>] netlink_rcv_skb+0xd0/0x130 > [<6b7c977a>] genl_rcv+0x34/0x44 > [<66b2d04d>] netlink_unicast+0x1b4/0x258 > [<f965b9b6>] netlink_sendmsg+0x1e8/0x428 > [<aadb8231>] ____sys_sendmsg+0x1e0/0x274 > [<d2b5212d>] ___sys_sendmsg+0x80/0xb4 > [<69954f45>] __sys_sendmsg+0x64/0xa8 > unreferenced object 0xce087000 (size 1024): > comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ > 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ > backtrace: > [<9a993714>] __kmalloc_track_caller+0x230/0x600 > [<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74 > [<a2c61343>] __alloc_skb+0xa0/0x170 > [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180 > [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] > [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] > [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx] > [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211] > [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211] > [<47bd8b68>] genl_rcv_msg+0x198/0x378 > [<453ef796>] netlink_rcv_skb+0xd0/0x130 > [<6b7c977a>] genl_rcv+0x34/0x44 > [<66b2d04d>] netlink_unicast+0x1b4/0x258 > [<f965b9b6>] netlink_sendmsg+0x1e8/0x428 > [<aadb8231>] ____sys_sendmsg+0x1e0/0x274 > [<d2b5212d>] ___sys_sendmsg+0x80/0xb4 > > However, since the kernel is build optimized, it seems the stack is not > accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue > is obvious in this function: memory allocated by ieee80211_beacon_get() > is never released. Fixing this leak makes kmemleak happy. > > Reported-by: Ulrich Mohr <u.mohr@semex-engcon.com> > Co-developed-by: Ulrich Mohr <u.mohr@semex-engcon.com> > Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com> > Fixes: 268bceec1684 ("staging: wfx: fix BA when device is AP and MFP is enabled") > Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Patch applied to wireless-next.git, thanks. b8cfb7c819dd wifi: wfx: fix memory leak when starting AP
diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c index 537caf9d914a7..bb4446b88c12b 100644 --- a/drivers/net/wireless/silabs/wfx/sta.c +++ b/drivers/net/wireless/silabs/wfx/sta.c @@ -344,6 +344,7 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif) const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16); const int pairwise_cipher_suite_size = 4 / sizeof(u16); const int akm_suite_size = 4 / sizeof(u16); + int ret = -EINVAL; const u16 *ptr; if (unlikely(!skb)) @@ -352,22 +353,26 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif) ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset, skb->len - ieoffset); if (unlikely(!ptr)) - return -EINVAL; + goto free_skb; ptr += pairwise_cipher_suite_count_offset; if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) - return -EINVAL; + goto free_skb; ptr += 1 + pairwise_cipher_suite_size * *ptr; if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) - return -EINVAL; + goto free_skb; ptr += 1 + akm_suite_size * *ptr; if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb))) - return -EINVAL; + goto free_skb; wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6)); - return 0; + ret = 0; + +free_skb: + dev_kfree_skb(skb); + return ret; } int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac [<127bdd74>] __alloc_skb+0x144/0x170 [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180 [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx] [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211] [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [<47bd8b68>] genl_rcv_msg+0x198/0x378 [<453ef796>] netlink_rcv_skb+0xd0/0x130 [<6b7c977a>] genl_rcv+0x34/0x44 [<66b2d04d>] netlink_unicast+0x1b4/0x258 [<f965b9b6>] netlink_sendmsg+0x1e8/0x428 [<aadb8231>] ____sys_sendmsg+0x1e0/0x274 [<d2b5212d>] ___sys_sendmsg+0x80/0xb4 [<69954f45>] __sys_sendmsg+0x64/0xa8 unreferenced object 0xce087000 (size 1024): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<9a993714>] __kmalloc_track_caller+0x230/0x600 [<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74 [<a2c61343>] __alloc_skb+0xa0/0x170 [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180 [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211] [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211] [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx] [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211] [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211] [<47bd8b68>] genl_rcv_msg+0x198/0x378 [<453ef796>] netlink_rcv_skb+0xd0/0x130 [<6b7c977a>] genl_rcv+0x34/0x44 [<66b2d04d>] netlink_unicast+0x1b4/0x258 [<f965b9b6>] netlink_sendmsg+0x1e8/0x428 [<aadb8231>] ____sys_sendmsg+0x1e0/0x274 [<d2b5212d>] ___sys_sendmsg+0x80/0xb4 However, since the kernel is build optimized, it seems the stack is not accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue is obvious in this function: memory allocated by ieee80211_beacon_get() is never released. Fixing this leak makes kmemleak happy. Reported-by: Ulrich Mohr <u.mohr@semex-engcon.com> Co-developed-by: Ulrich Mohr <u.mohr@semex-engcon.com> Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com> Fixes: 268bceec1684 ("staging: wfx: fix BA when device is AP and MFP is enabled") Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> --- drivers/net/wireless/silabs/wfx/sta.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)