rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A memory leak in the crypto_reportstat() function in drivers/virt/vboxguest/vboxguest_utils.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering copy_form_user() failures, aka CID-e0b0cb938864.
Vulnerability ID: CVE-2019-19048
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/virt/vboxguest/vboxguest_utils.c
Commit message: virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr

In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but
is not released if copy_form_user fails. In order to prevent memory leak
in case of failure, the assignment to bounce_buf_ret is moved before the
error check. This way the allocated bounce_buf will be released by the
caller.

Fixes: 579db9d45cb4 ("virt: Add vboxguest VMMDEV communication code")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20190930204223.3660-1-navid.emamdoost@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int hgcm_call_preprocess_linaddr( 	if (!bounce_buf) 		return -ENOMEM;  	if (copy_in) { 		ret = copy_from_user(bounce_buf, (void __user *)buf, len); 		if (ret) static int hgcm_call_preprocess_linaddr( 		memset(bounce_buf, 0, len); 	}  	*bounce_buf_ret = bounce_buf; 	hgcm_call_add_pagelist_size(bounce_buf, len, extra); 	return 0; }

Fixed version (after fix):
 static int hgcm_call_preprocess_linaddr( 	if (!bounce_buf) 		return -ENOMEM;  	*bounce_buf_ret = bounce_buf;  	if (copy_in) { 		ret = copy_from_user(bounce_buf, (void __user *)buf, len); 		if (ret) static int hgcm_call_preprocess_linaddr( 		memset(bounce_buf, 0, len); 	}  	hgcm_call_add_pagelist_size(bounce_buf, len, extra); 	return 0; }

Patch:
patch: @@ -220,6 +220,8 @@ static int hgcm_call_preprocess_linaddr(
 	if (!bounce_buf)
 		return -ENOMEM;
 
+	*bounce_buf_ret = bounce_buf;
+
 	if (copy_in) {
 		ret = copy_from_user(bounce_buf, (void __user *)buf, len);
 		if (ret)
@@ -228,7 +230,6 @@ static int hgcm_call_preprocess_linaddr(
 		memset(bounce_buf, 0, len);
 	}
 
-	*bounce_buf_ret = bounce_buf;
 	hgcm_call_add_pagelist_size(bounce_buf, len, extra);
 	return 0;
 }
path: drivers/virt/vboxguest/vboxguest_utils.c
Vulnerability: ** DISPUTED ** A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot.
Vulnerability ID: CVE-2019-19049
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/of/unittest.c
Commit message: of: unittest: fix memory leak in unittest_data_add

In unittest_data_add, a copy buffer is created via kmemdup. This buffer
is leaked if of_fdt_unflatten_tree fails. The release for the
unittest_data buffer is added.

Fixes: b951f9dc7f25 ("Enabling OF selftest to run without machine's devicetree")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Frank Rowand <frowand.list@gmail.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int __init unittest_data_add(void) 	of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node); 	if (!unittest_data_node) { 		pr_warn("%s: No tree to attach; not running tests\n", __func__); 		return -ENODATA; 	} 

Fixed version (after fix):
 static int __init unittest_data_add(void) 	of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node); 	if (!unittest_data_node) { 		pr_warn("%s: No tree to attach; not running tests\n", __func__); 		kfree(unittest_data); 		return -ENODATA; 	} 

Patch:
patch: @@ -1207,6 +1207,7 @@ static int __init unittest_data_add(void)
 	of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node);
 	if (!unittest_data_node) {
 		pr_warn("%s: No tree to attach; not running tests\n", __func__);
+		kfree(unittest_data);
 		return -ENODATA;
 	}
path: drivers/of/unittest.c
Vulnerability: A memory leak in the crypto_reportstat() function in crypto/crypto_user_stat.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_reportstat_alg() failures, aka CID-c03b04dcdba1.
Vulnerability ID: CVE-2019-19050
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: crypto/crypto_user_stat.c
Commit message: crypto: user - fix memory leak in crypto_reportstat

In crypto_reportstat, a new skb is created by nlmsg_new(). This skb is
leaked if crypto_reportstat_alg() fails. Required release for skb is
added.

Fixes: cac5818c25d0 ("crypto: user - Implement a generic crypto statistics")
Cc: <stable@vger.kernel.org>
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int crypto_reportstat(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, drop_alg: 	crypto_mod_put(alg);  	if (err) 		return err;  	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid); }

Fixed version (after fix):
 int crypto_reportstat(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, drop_alg: 	crypto_mod_put(alg);  	if (err) { 		kfree_skb(skb); 		return err; 	}  	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid); }

Patch:
patch: @@ -328,8 +328,10 @@ int crypto_reportstat(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
 drop_alg:
 	crypto_mod_put(alg);
 
-	if (err)
+	if (err) {
+		kfree_skb(skb);
 		return err;
+	}
 
 	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid);
 }
path: crypto/crypto_user_stat.c
Vulnerability: A memory leak in the i2400m_op_rfkill_sw_toggle() function in drivers/net/wimax/i2400m/op-rfkill.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-6f3ef5c25cc7.
Vulnerability ID: CVE-2019-19051
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wimax/i2400m/op-rfkill.c
Commit message: wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle

In the implementation of i2400m_op_rfkill_sw_toggle() the allocated
buffer for cmd should be released before returning. The
documentation for i2400m_msg_to_dev() says when it returns the buffer
can be reused. Meaning cmd should be released in either case. Move
kfree(cmd) before return to be reached by all execution paths.

Fixes: 2507e6ab7a9a ("wimax: i2400: fix memory leak")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev, 			"%d\n", result); 	result = 0; error_cmd: 	kfree(cmd); 	kfree_skb(ack_skb); error_msg_to_dev: error_alloc: 	d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n", 		wimax_dev, state, result); 	return result; } 

Fixed version (after fix):
 int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev, 			"%d\n", result); 	result = 0; error_cmd: 	kfree_skb(ack_skb); error_msg_to_dev: error_alloc: 	d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n", 		wimax_dev, state, result); 	kfree(cmd); 	return result; } 

Patch:
patch: @@ -127,12 +127,12 @@ int i2400m_op_rfkill_sw_toggle(struct wimax_dev *wimax_dev,
 			"%d\n", result);
 	result = 0;
 error_cmd:
-	kfree(cmd);
 	kfree_skb(ack_skb);
 error_msg_to_dev:
 error_alloc:
 	d_fnend(4, dev, "(wimax_dev %p state %d) = %d\n",
 		wimax_dev, state, result);
+	kfree(cmd);
 	return result;
 }
path: drivers/net/wimax/i2400m/op-rfkill.c
Vulnerability: A memory leak in the gs_can_open() function in drivers/net/can/usb/gs_usb.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-fb5be6a7b486.
Vulnerability ID: CVE-2019-19052
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/can/usb/gs_usb.c
Commit message: can: gs_usb: gs_can_open(): prevent memory leak

In gs_can_open() if usb_submit_urb() fails the allocated urb should be
released.

Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int gs_can_open(struct net_device *netdev) 					   rc);  				usb_unanchor_urb(urb); 				break; 			} 

Fixed version (after fix):
 static int gs_can_open(struct net_device *netdev) 					   rc);  				usb_unanchor_urb(urb); 				usb_free_urb(urb); 				break; 			} 

Patch:
patch: @@ -623,6 +623,7 @@ static int gs_can_open(struct net_device *netdev)
 					   rc);
 
 				usb_unanchor_urb(urb);
+				usb_free_urb(urb);
 				break;
 			}
path: drivers/net/can/usb/gs_usb.c
Vulnerability: A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy_from_iter_full() failures, aka CID-bbe692e349e2.
Vulnerability ID: CVE-2019-19053
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/rpmsg/rpmsg_char.c
Commit message: rpmsg: char: release allocated memory

In rpmsg_eptdev_write_iter, if copy_from_iter_full fails the allocated
buffer needs to be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb, 	if (!kbuf) 		return -ENOMEM;  	if (!copy_from_iter_full(kbuf, len, from)) 		return -EFAULT;  	if (mutex_lock_interruptible(&eptdev->ept_lock)) { 		ret = -ERESTARTSYS;

Fixed version (after fix):
 static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb, 	if (!kbuf) 		return -ENOMEM;  	if (!copy_from_iter_full(kbuf, len, from)) { 		ret = -EFAULT; 		goto free_kbuf; 	}  	if (mutex_lock_interruptible(&eptdev->ept_lock)) { 		ret = -ERESTARTSYS;

Patch:
patch: @@ -227,8 +227,10 @@ static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb,
 	if (!kbuf)
 		return -ENOMEM;
 
-	if (!copy_from_iter_full(kbuf, len, from))
-		return -EFAULT;
+	if (!copy_from_iter_full(kbuf, len, from)) {
+		ret = -EFAULT;
+		goto free_kbuf;
+	}
 
 	if (mutex_lock_interruptible(&eptdev->ept_lock)) {
 		ret = -ERESTARTSYS;
path: drivers/rpmsg/rpmsg_char.c
Vulnerability: A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.
Vulnerability ID: CVE-2019-19054
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/media/pci/cx23885/cx23888-ir.c
Commit message: media: rc: prevent memory leak in cx23888_ir_probe

In cx23888_ir_probe if kfifo_alloc fails the allocated memory for state
should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int cx23888_ir_probe(struct cx23885_dev *dev) 		return -ENOMEM;  	spin_lock_init(&state->rx_kfifo_lock); 	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL)) 		return -ENOMEM;  	state->dev = dev; 	sd = &state->sd;

Fixed version (after fix):
 int cx23888_ir_probe(struct cx23885_dev *dev) 		return -ENOMEM;  	spin_lock_init(&state->rx_kfifo_lock); 	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, 			GFP_KERNEL)) { 		kfree(state); 		return -ENOMEM; 	}  	state->dev = dev; 	sd = &state->sd;

Patch:
patch: @@ -1167,8 +1167,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev)
 		return -ENOMEM;
 
 	spin_lock_init(&state->rx_kfifo_lock);
-	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL))
+	if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE,
+			GFP_KERNEL)) {
+		kfree(state);
 		return -ENOMEM;
+	}
 
 	state->dev = dev;
 	sd = &state->sd;
path: drivers/media/pci/cx23885/cx23888-ir.c
Vulnerability: ** DISPUTED ** A memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering nl80211hdr_put() failures, aka CID-1399c59fa929. NOTE: third parties dispute the relevance of this because it occurs on a code path where a successful allocation has already occurred.
Vulnerability ID: CVE-2019-19055
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: net/wireless/nl80211.c
Commit message: nl80211: fix memory leak in nl80211_get_ftm_responder_stats

In nl80211_get_ftm_responder_stats, a new skb is created via nlmsg_new
named msg. If nl80211hdr_put() fails, then msg should be released. The
return statement should be replace by goto to error handling code.

Fixes: 81e54d08d9d8 ("cfg80211: support FTM responder configuration/statistics")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191004194220.19412-1-navid.emamdoost@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 			     NL80211_CMD_GET_FTM_RESPONDER_STATS); 	if (!hdr) 		return -ENOBUFS;  	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 		goto nla_put_failure;

Fixed version (after fix):
 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 			     NL80211_CMD_GET_FTM_RESPONDER_STATS); 	if (!hdr) 		goto nla_put_failure;  	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 		goto nla_put_failure;

Patch:
patch: @@ -13682,7 +13682,7 @@ static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
 			     NL80211_CMD_GET_FTM_RESPONDER_STATS);
 	if (!hdr)
-		return -ENOBUFS;
+		goto nla_put_failure;
 
 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
 		goto nla_put_failure;
path: net/wireless/nl80211.c
Vulnerability: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-db8fd2cde932.
Vulnerability ID: CVE-2019-19056
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/marvell/mwifiex/pcie.c
Commit message: mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf

In mwifiex_pcie_alloc_cmdrsp_buf, a new skb is allocated which should be
released if mwifiex_map_pci_memory() fails. The release is added.

Fixes: fc3314609047 ("mwifiex: use pci_alloc/free_consistent APIs for PCIe")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) 	} 	skb_put(skb, MWIFIEX_UPLD_SIZE); 	if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, 				   PCI_DMA_FROMDEVICE)) 		return -1;  	card->cmdrsp_buf = skb; 

Fixed version (after fix):
 static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter) 	} 	skb_put(skb, MWIFIEX_UPLD_SIZE); 	if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE, 				   PCI_DMA_FROMDEVICE)) { 		kfree_skb(skb); 		return -1; 	}  	card->cmdrsp_buf = skb; 

Patch:
patch: @@ -1029,8 +1029,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
 	}
 	skb_put(skb, MWIFIEX_UPLD_SIZE);
 	if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
-				   PCI_DMA_FROMDEVICE))
+				   PCI_DMA_FROMDEVICE)) {
+		kfree_skb(skb);
 		return -1;
+	}
 
 	card->cmdrsp_buf = skb;
path: drivers/net/wireless/marvell/mwifiex/pcie.c
Vulnerability: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e.
Vulnerability ID: CVE-2019-19057
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/marvell/mwifiex/pcie.c
Commit message: mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring

In mwifiex_pcie_init_evt_ring, a new skb is allocated which should be
released if mwifiex_map_pci_memory() fails. The release for skb and
card->evtbd_ring_vbase is added.

Fixes: 0732484b47b5 ("mwifiex: separate ring initialization and ring creation routines")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) 		skb_put(skb, MAX_EVENT_SIZE);  		if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, 					   PCI_DMA_FROMDEVICE)) 			return -1;  		buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); 

Fixed version (after fix):
 static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) 		skb_put(skb, MAX_EVENT_SIZE);  		if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, 					   PCI_DMA_FROMDEVICE)) { 			kfree_skb(skb); 			kfree(card->evtbd_ring_vbase); 			return -1; 		}  		buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); 

Patch:
patch: @@ -687,8 +687,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
 		skb_put(skb, MAX_EVENT_SIZE);
 
 		if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
-					   PCI_DMA_FROMDEVICE))
+					   PCI_DMA_FROMDEVICE)) {
+			kfree_skb(skb);
+			kfree(card->evtbd_ring_vbase);
 			return -1;
+		}
 
 		buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
path: drivers/net/wireless/marvell/mwifiex/pcie.c
Vulnerability: A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering alloc_page() failures, aka CID-b4b814fec1a5.
Vulnerability ID: CVE-2019-19058
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/intel/iwlwifi/fw/dbg.c
Commit message: iwlwifi: dbg_ini: fix memory leak in alloc_sgtable

In alloc_sgtable if alloc_page fails, the alocated table should be
released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static struct scatterlist *alloc_sgtable(int size) 				if (new_page) 					__free_page(new_page); 			} 			return NULL; 		} 		alloc_size = min_t(int, size, PAGE_SIZE);

Fixed version (after fix):
 static struct scatterlist *alloc_sgtable(int size) 				if (new_page) 					__free_page(new_page); 			} 			kfree(table); 			return NULL; 		} 		alloc_size = min_t(int, size, PAGE_SIZE);

Patch:
patch: @@ -646,6 +646,7 @@ static struct scatterlist *alloc_sgtable(int size)
 				if (new_page)
 					__free_page(new_page);
 			}
+			kfree(table);
 			return NULL;
 		}
 		alloc_size = min_t(int, size, PAGE_SIZE);
path: drivers/net/wireless/intel/iwlwifi/fw/dbg.c
Vulnerability: A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.
Vulnerability ID: CVE-2019-19060
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/iio/imu/adis_buffer.c
Commit message: iio: imu: adis16400: release allocated memory on failure

In adis_update_scan_mode, if allocation for adis->buffer fails,
previously allocated adis->xfer needs to be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int adis_update_scan_mode(struct iio_dev *indio_dev, 		return -ENOMEM;  	adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL); 	if (!adis->buffer) 		return -ENOMEM;  	rx = adis->buffer; 	tx = rx + scan_count;

Fixed version (after fix):
 int adis_update_scan_mode(struct iio_dev *indio_dev, 		return -ENOMEM;  	adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL); 	if (!adis->buffer) { 		kfree(adis->xfer); 		adis->xfer = NULL; 		return -ENOMEM; 	}  	rx = adis->buffer; 	tx = rx + scan_count;

Patch:
patch: @@ -78,8 +78,11 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
 		return -ENOMEM;
 
 	adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL);
-	if (!adis->buffer)
+	if (!adis->buffer) {
+		kfree(adis->xfer);
+		adis->xfer = NULL;
 		return -ENOMEM;
+	}
 
 	rx = adis->buffer;
 	tx = rx + scan_count;
path: drivers/iio/imu/adis_buffer.c
Vulnerability: A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.
Vulnerability ID: CVE-2019-19061
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/iio/imu/adis_buffer.c
Commit message: iio: imu: adis16400: fix memory leak

In adis_update_scan_mode_burst, if adis->buffer allocation fails release
the adis->xfer.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int adis_update_scan_mode_burst(struct iio_dev *indio_dev, 		return -ENOMEM;  	adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL); 	if (!adis->buffer) 		return -ENOMEM;  	tx = adis->buffer + burst_length; 	tx[0] = ADIS_READ_REG(adis->burst->reg_cmd);

Fixed version (after fix):
 static int adis_update_scan_mode_burst(struct iio_dev *indio_dev, 		return -ENOMEM;  	adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL); 	if (!adis->buffer) { 		kfree(adis->xfer); 		adis->xfer = NULL; 		return -ENOMEM; 	}  	tx = adis->buffer + burst_length; 	tx[0] = ADIS_READ_REG(adis->burst->reg_cmd);

Patch:
patch: @@ -35,8 +35,11 @@ static int adis_update_scan_mode_burst(struct iio_dev *indio_dev,
 		return -ENOMEM;
 
 	adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL);
-	if (!adis->buffer)
+	if (!adis->buffer) {
+		kfree(adis->xfer);
+		adis->xfer = NULL;
 		return -ENOMEM;
+	}
 
 	tx = adis->buffer + burst_length;
 	tx[0] = ADIS_READ_REG(adis->burst->reg_cmd);
path: drivers/iio/imu/adis_buffer.c