Fwd: Potential memory leak bug in mwifiex_init_rxq_ring()

[Dongyang Zhan <zdyzztq@xxxxxxxxx>]

---------- Forwarded message ---------
发件人： Dongyang Zhan <zdyzztq@xxxxxxxxx>
Date: 2020年5月3日周日 下午2:16
Subject: Potential memory leak bug in mwifiex_init_rxq_ring()
To: <akarwar@xxxxxxxxxxx>
Cc: <linux-wireless@xxxxxxxxxxxxxxx>


Hi,

I am a security researcher. I found a potential bug in
/drivers/net/wireless/marvell/mwifiex/pcie.c. I hope you can help me
to confirm it.

Potential memory leak in mwifiex_init_rxq_ring()
(/drivers/net/wireless/marvell/mwifiex/pcie.c) when triggering
mwifiex_map_pci_memory() fails.

Source Code:
skb = mwifiex_alloc_dma_align_buf(MWIFIEX_RX_DATA_BUF_SIZE,
 GFP_KERNEL);
if (!skb) {
mwifiex_dbg(adapter, ERROR,
   "Unable to allocate skb for RX ring.\n");
kfree(card->rxbd_ring_vbase);
return -ENOMEM;
}

if (mwifiex_map_pci_memory(adapter, skb,
  MWIFIEX_RX_DATA_BUF_SIZE,
  PCI_DMA_FROMDEVICE))
return -1;//skb is not released

...
}

Thank you.