diff mbox series

wifi: wfx: fix memory leak when starting AP

Message ID 20240202164213.1606145-1-jerome.pouiller@silabs.com
State New
Headers
Series wifi: wfx: fix memory leak when starting AP |

Commit Message

Jérôme Pouiller Feb. 2, 2024, 4:42 p.m. UTC 
  Kmemleak reported this error:

    unreferenced object 0xd73d1180 (size 184):
      comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00  ................
      backtrace:
        [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac
        [<127bdd74>] __alloc_skb+0x144/0x170
        [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180
        [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
        [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
        [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]
        [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]
        [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
        [<47bd8b68>] genl_rcv_msg+0x198/0x378
        [<453ef796>] netlink_rcv_skb+0xd0/0x130
        [<6b7c977a>] genl_rcv+0x34/0x44
        [<66b2d04d>] netlink_unicast+0x1b4/0x258
        [<f965b9b6>] netlink_sendmsg+0x1e8/0x428
        [<aadb8231>] ____sys_sendmsg+0x1e0/0x274
        [<d2b5212d>] ___sys_sendmsg+0x80/0xb4
        [<69954f45>] __sys_sendmsg+0x64/0xa8
    unreferenced object 0xce087000 (size 1024):
      comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
      backtrace:
        [<9a993714>] __kmalloc_track_caller+0x230/0x600
        [<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74
        [<a2c61343>] __alloc_skb+0xa0/0x170
        [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180
        [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
        [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
        [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]
        [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]
        [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
        [<47bd8b68>] genl_rcv_msg+0x198/0x378
        [<453ef796>] netlink_rcv_skb+0xd0/0x130
        [<6b7c977a>] genl_rcv+0x34/0x44
        [<66b2d04d>] netlink_unicast+0x1b4/0x258
        [<f965b9b6>] netlink_sendmsg+0x1e8/0x428
        [<aadb8231>] ____sys_sendmsg+0x1e0/0x274
        [<d2b5212d>] ___sys_sendmsg+0x80/0xb4

However, since the kernel is build optimized, it seems the stack is not
accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue
is obvious in this function: memory allocated by ieee80211_beacon_get()
is never released. Fixing this leak makes kmemleak happy.

Reported-by: Ulrich Mohr <u.mohr@semex-engcon.com>
Co-developed-by: Ulrich Mohr <u.mohr@semex-engcon.com>
Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com>
Fixes: 268bceec1684 ("staging: wfx: fix BA when device is AP and MFP is enabled")
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
---
 drivers/net/wireless/silabs/wfx/sta.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

Comments

Kalle Valo Feb. 6, 2024, 6:06 p.m. UTC | #1 
Jérôme Pouiller <jerome.pouiller@silabs.com> wrote:

> Kmemleak reported this error:
> 
>     unreferenced object 0xd73d1180 (size 184):
>       comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s)
>       hex dump (first 32 bytes):
>         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>         00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00  ................
>       backtrace:
>         [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac
>         [<127bdd74>] __alloc_skb+0x144/0x170
>         [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180
>         [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
>         [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
>         [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]
>         [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]
>         [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
>         [<47bd8b68>] genl_rcv_msg+0x198/0x378
>         [<453ef796>] netlink_rcv_skb+0xd0/0x130
>         [<6b7c977a>] genl_rcv+0x34/0x44
>         [<66b2d04d>] netlink_unicast+0x1b4/0x258
>         [<f965b9b6>] netlink_sendmsg+0x1e8/0x428
>         [<aadb8231>] ____sys_sendmsg+0x1e0/0x274
>         [<d2b5212d>] ___sys_sendmsg+0x80/0xb4
>         [<69954f45>] __sys_sendmsg+0x64/0xa8
>     unreferenced object 0xce087000 (size 1024):
>       comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s)
>       hex dump (first 32 bytes):
>         00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>         10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
>       backtrace:
>         [<9a993714>] __kmalloc_track_caller+0x230/0x600
>         [<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74
>         [<a2c61343>] __alloc_skb+0xa0/0x170
>         [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180
>         [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
>         [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
>         [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]
>         [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]
>         [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
>         [<47bd8b68>] genl_rcv_msg+0x198/0x378
>         [<453ef796>] netlink_rcv_skb+0xd0/0x130
>         [<6b7c977a>] genl_rcv+0x34/0x44
>         [<66b2d04d>] netlink_unicast+0x1b4/0x258
>         [<f965b9b6>] netlink_sendmsg+0x1e8/0x428
>         [<aadb8231>] ____sys_sendmsg+0x1e0/0x274
>         [<d2b5212d>] ___sys_sendmsg+0x80/0xb4
> 
> However, since the kernel is build optimized, it seems the stack is not
> accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue
> is obvious in this function: memory allocated by ieee80211_beacon_get()
> is never released. Fixing this leak makes kmemleak happy.
> 
> Reported-by: Ulrich Mohr <u.mohr@semex-engcon.com>
> Co-developed-by: Ulrich Mohr <u.mohr@semex-engcon.com>
> Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com>
> Fixes: 268bceec1684 ("staging: wfx: fix BA when device is AP and MFP is enabled")
> Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>

Patch applied to wireless-next.git, thanks.

b8cfb7c819dd wifi: wfx: fix memory leak when starting AP
diff mbox series

Patch

diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
index 537caf9d914a7..bb4446b88c12b 100644
--- a/drivers/net/wireless/silabs/wfx/sta.c
+++ b/drivers/net/wireless/silabs/wfx/sta.c
@@ -344,6 +344,7 @@  static int wfx_set_mfp_ap(struct wfx_vif *wvif)
 	const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16);
 	const int pairwise_cipher_suite_size = 4 / sizeof(u16);
 	const int akm_suite_size = 4 / sizeof(u16);
+	int ret = -EINVAL;
 	const u16 *ptr;
 
 	if (unlikely(!skb))
@@ -352,22 +353,26 @@  static int wfx_set_mfp_ap(struct wfx_vif *wvif)
 	ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,
 				      skb->len - ieoffset);
 	if (unlikely(!ptr))
-		return -EINVAL;
+		goto free_skb;
 
 	ptr += pairwise_cipher_suite_count_offset;
 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
-		return -EINVAL;
+		goto free_skb;
 
 	ptr += 1 + pairwise_cipher_suite_size * *ptr;
 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
-		return -EINVAL;
+		goto free_skb;
 
 	ptr += 1 + akm_suite_size * *ptr;
 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
-		return -EINVAL;
+		goto free_skb;
 
 	wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));
-	return 0;
+	ret = 0;
+
+free_skb:
+	dev_kfree_skb(skb);
+	return ret;
 }
 
 int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,