Fwd: Potential memory leak bug in rtl8xxxu_tx() by triggering usb_submit_urb() failures

[Dongyang Zhan <zdyzztq@xxxxxxxxx>]

---------- Forwarded message ---------
发件人： Dongyang Zhan <zdyzztq@xxxxxxxxx>
Date: 2020年5月3日周日 下午2:45
Subject: Potential memory leak bug in rtl8xxxu_tx() by triggering
usb_submit_urb() failures
To: <linux-wireless@xxxxxxxxxxxxxxx>


Hi,

I am a security researcher, my name is Dongyang Zhan. I found a potential bug in

/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in Linux
4.10.17. I hope you can help me to confirm it.

If usb_submit_urb() fails, usb_unanchor_urb cannot free tx_urb->urb,
causing memory consumption bug. This bug is similar with
CVE-2019-19068, which adds usb_free_urb() as bug fix.

Thank you.