Vulnerability: Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allow attackers to cause a denial of service (memory consumption), aka CID-8572cea1461a.
Vulnerability ID: CVE-2019-19080
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ethernet/netronome/nfp/flower/main.c
Commit message: nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs

In nfp_flower_spawn_phy_reprs, in the for loop over eth_tbl if any of
intermediate allocations or initializations fail memory is leaked.
requiered releases are added.

Fixes: b94524529741 ("nfp: flower: add per repr private data for LAG offload")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) 		repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL); 		if (!repr_priv) { 			err = -ENOMEM; 			goto err_reprs_clean; 		}  nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) 		port = nfp_port_alloc(app, NFP_PORT_PHYS_PORT, repr); 		if (IS_ERR(port)) { 			err = PTR_ERR(port); 			nfp_repr_free(repr); 			goto err_reprs_clean; 		} 		err = nfp_port_init_phy_port(app->pf, app, port, i); 		if (err) { 			nfp_port_free(port); 			nfp_repr_free(repr); 			goto err_reprs_clean; nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) 		err = nfp_repr_init(app, repr, 				    cmsg_port_id, port, priv->nn->dp.netdev); 		if (err) { 			nfp_port_free(port); 			nfp_repr_free(repr); 			goto err_reprs_clean;

Fixed version (after fix):
 nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) 		repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL); 		if (!repr_priv) { 			err = -ENOMEM; 			nfp_repr_free(repr); 			goto err_reprs_clean; 		}  nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) 		port = nfp_port_alloc(app, NFP_PORT_PHYS_PORT, repr); 		if (IS_ERR(port)) { 			err = PTR_ERR(port); 			kfree(repr_priv); 			nfp_repr_free(repr); 			goto err_reprs_clean; 		} 		err = nfp_port_init_phy_port(app->pf, app, port, i); 		if (err) { 			kfree(repr_priv); 			nfp_port_free(port); 			nfp_repr_free(repr); 			goto err_reprs_clean; nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv) 		err = nfp_repr_init(app, repr, 				    cmsg_port_id, port, priv->nn->dp.netdev); 		if (err) { 			kfree(repr_priv); 			nfp_port_free(port); 			nfp_repr_free(repr); 			goto err_reprs_clean;

Patch:
patch: @@ -515,6 +515,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
 		repr_priv = kzalloc(sizeof(*repr_priv), GFP_KERNEL);
 		if (!repr_priv) {
 			err = -ENOMEM;
+			nfp_repr_free(repr);
 			goto err_reprs_clean;
 		}
 
@@ -525,11 +526,13 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
 		port = nfp_port_alloc(app, NFP_PORT_PHYS_PORT, repr);
 		if (IS_ERR(port)) {
 			err = PTR_ERR(port);
+			kfree(repr_priv);
 			nfp_repr_free(repr);
 			goto err_reprs_clean;
 		}
 		err = nfp_port_init_phy_port(app->pf, app, port, i);
 		if (err) {
+			kfree(repr_priv);
 			nfp_port_free(port);
 			nfp_repr_free(repr);
 			goto err_reprs_clean;
@@ -542,6 +545,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
 		err = nfp_repr_init(app, repr,
 				    cmsg_port_id, port, priv->nn->dp.netdev);
 		if (err) {
+			kfree(repr_priv);
 			nfp_port_free(port);
 			nfp_repr_free(repr);
 			goto err_reprs_clean;
path: drivers/net/ethernet/netronome/nfp/flower/main.c