From patchwork Fri Apr 14 10:12:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Greenman, Gregory" X-Patchwork-Id: 673818 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A988CC77B6F for ; Fri, 14 Apr 2023 10:15:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229841AbjDNKPu (ORCPT ); Fri, 14 Apr 2023 06:15:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229764AbjDNKPt (ORCPT ); Fri, 14 Apr 2023 06:15:49 -0400 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5BE86595 for ; Fri, 14 Apr 2023 03:15:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1681467327; x=1713003327; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=kERZ6oeS++p/UiytDKvLRaB7aKgM/25NLy1+WsK1vsg=; b=fMgXbyBDzD9PYG9NdNQzfmI2cNzkmFbMnxDUIHjlZDOnNVK1iQ2C1sSA NIFtv2Xq9o02UvDgZGuRORSRDZiP/2wts/jhN9wdrgfMmkNaLIN5kpP10 GbFfdX+bBYFRwSNxGs9EKNTRZkNSjgXRR3NVqrlh2Aclsj9bRG7aQIDnZ OOZifUygMB6/jgLXVzzKh1+XskBza7R5QyfaHlYWiWdoWf3eZOf6bYAwm dKM8oIvzyHG9ovW94eIryBy1mURY8XzKPdJwH/C4lKaTXJQ7hgeZNhJ9Y TROiHndEgQa/OvHcpHna/jQcQNqE2BGGw6xWCHiNh58UkBM+n6fpPyt2i w==; X-IronPort-AV: E=McAfee;i="6600,9927,10679"; a="346263673" X-IronPort-AV: E=Sophos;i="5.99,195,1677571200"; d="scan'208";a="346263673" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Apr 2023 03:12:42 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10679"; a="692351797" X-IronPort-AV: E=Sophos;i="5.99,195,1677571200"; d="scan'208";a="692351797" Received: from yalankry-mobl.ger.corp.intel.com (HELO ggreenma-mobl2.lan) ([10.214.233.156]) by fmsmga007-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Apr 2023 03:12:40 -0700 From: gregory.greenman@intel.com To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Johannes Berg , Gregory Greenman Subject: [PATCH 11/15] wifi: iwlwifi: mvm: fix ptk_pn memory leak Date: Fri, 14 Apr 2023 13:12:02 +0300 Message-Id: <20230414130637.99446ffd02bc.I82a2ad6ec1395f188e0a1677cc619e3fcb1feac9@changeid> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20230414101206.1170180-1-gregory.greenman@intel.com> References: <20230414101206.1170180-1-gregory.greenman@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Johannes Berg If adding a key to firmware fails we leak the allocated ptk_pn. This shouldn't happen in practice, but we should still fix it. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman --- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c index 1670c2cef4c3..540d6e3e30d4 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -4107,7 +4107,7 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); struct iwl_mvm_sta *mvmsta = NULL; - struct iwl_mvm_key_pn *ptk_pn; + struct iwl_mvm_key_pn *ptk_pn = NULL; int keyidx = key->keyidx; u32 sec_key_id = WIDE_ID(DATA_PATH_GROUP, SEC_KEY_CMD); u8 sec_key_ver = iwl_fw_lookup_cmd_ver(mvm->fw, sec_key_id, 0); @@ -4265,6 +4265,10 @@ static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, if (ret) { IWL_WARN(mvm, "set key failed\n"); key->hw_key_idx = STA_KEY_IDX_INVALID; + if (ptk_pn) { + RCU_INIT_POINTER(mvmsta->ptk_pn[keyidx], NULL); + kfree(ptk_pn); + } /* * can't add key for RX, but we don't need it * in the device for TX so still return 0,