rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
Vulnerability ID: CVE-2019-18656
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/pimcore/pimcore
Published: 2019-10-31
File: bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
Commit message: Fixed possible XSS in the translations grid
Commit author: Bernhard Rusch

Vulnerable version (before fix):
 pimcore.settings.translations = Class.create({                 dataIndex: "_" + languages[i],                 filter: 'string',                 getEditor: this.getCellEditor.bind(this, languages[i]),                 id: "translation_column_" + this.translationType + "_" + languages[i].toLowerCase()             };             if (applyInitialSettings) {

Fixed version (after fix):
 pimcore.settings.translations = Class.create({                 dataIndex: "_" + languages[i],                 filter: 'string',                 getEditor: this.getCellEditor.bind(this, languages[i]),                 renderer: function (text) {                     return replace_html_event_attributes(strip_tags(text, 'div,span,b,strong,em,i,small,sup,sub,p'));                 },                 id: "translation_column_" + this.translationType + "_" + languages[i].toLowerCase()             };             if (applyInitialSettings) {

Patch:
patch: @@ -102,6 +102,9 @@ pimcore.settings.translations = Class.create({
                 dataIndex: "_" + languages[i],
                 filter: 'string',
                 getEditor: this.getCellEditor.bind(this, languages[i]),
+                renderer: function (text) {
+                    return replace_html_event_attributes(strip_tags(text, 'div,span,b,strong,em,i,small,sup,sub,p'));
+                },
                 id: "translation_column_" + this.translationType + "_" + languages[i].toLowerCase()
             };
             if (applyInitialSettings) {
path: bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
Vulnerability: A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-128c66429247.
Vulnerability ID: CVE-2019-18808
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-11-07
File: drivers/crypto/ccp/ccp-ops.c
Commit message: crypto: ccp - Release all allocated memory if sha type is invalid

Release all allocated memory if sha type is invalid:
In ccp_run_sha_cmd, if the type of sha is invalid, the allocated
hmac_buf should be released.

v2: fix the goto.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Gary R Hook <gary.hook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) 			       LSB_ITEM_SIZE); 			break; 		default: 			ret = -EINVAL; 			goto e_ctx; 		}  		memset(&hmac_cmd, 0, sizeof(hmac_cmd));

Fixed version (after fix):
 ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) 			       LSB_ITEM_SIZE); 			break; 		default: 			kfree(hmac_buf); 			ret = -EINVAL; 			goto e_data; 		}  		memset(&hmac_cmd, 0, sizeof(hmac_cmd));

Patch:
patch: @@ -1777,8 +1777,9 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 			       LSB_ITEM_SIZE);
 			break;
 		default:
+			kfree(hmac_buf);
 			ret = -EINVAL;
-			goto e_ctx;
+			goto e_data;
 		}
 
 		memset(&hmac_cmd, 0, sizeof(hmac_cmd));
path: drivers/crypto/ccp/ccp-ops.c
Vulnerability: A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559.
Vulnerability ID: CVE-2019-18809
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-07
File: drivers/media/usb/dvb-usb/af9005.c
Commit message: media: usb: fix memory leak in af9005_identify_state

In af9005_identify_state when returning -EIO the allocated buffer should
be released. Replace the "return -EIO" with assignment into ret and move
deb_info() under a check.

Fixes: af4e067e1dcf ("V4L/DVB (5625): Add support for the AF9005 demodulator from Afatech")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int af9005_identify_state(struct usb_device *udev, 	else if (reply == 0x02) 		*cold = 0; 	else 		return -EIO; 	deb_info("Identify state cold = %d\n", *cold);  err: 	kfree(buf);

Fixed version (after fix):
 static int af9005_identify_state(struct usb_device *udev, 	else if (reply == 0x02) 		*cold = 0; 	else 		ret = -EIO; 	if (!ret) 		deb_info("Identify state cold = %d\n", *cold);  err: 	kfree(buf);

Patch:
patch: @@ -976,8 +976,9 @@ static int af9005_identify_state(struct usb_device *udev,
 	else if (reply == 0x02)
 		*cold = 0;
 	else
-		return -EIO;
-	deb_info("Identify state cold = %d\n", *cold);
+		ret = -EIO;
+	if (!ret)
+		deb_info("Identify state cold = %d\n", *cold);
 
 err:
 	kfree(buf);
path: drivers/media/usb/dvb-usb/af9005.c
Vulnerability: A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1.
Vulnerability ID: CVE-2019-18811
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-07
File: sound/soc/sof/ipc.c
Commit message: ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data

In the implementation of sof_set_get_large_ctrl_data() there is a memory
leak in case an error. Release partdata if sof_get_ctrl_copy_params()
fails.

Fixes: 54d198d5019d ("ASoC: SOF: Propagate sof_get_ctrl_copy_params() error properly")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191027215330.12729-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev, 	else 		err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata, 					       sparams); 	if (err < 0) 		return err;  	msg_bytes = sparams->msg_bytes; 	pl_size = sparams->pl_size;

Fixed version (after fix):
 static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev, 	else 		err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata, 					       sparams); 	if (err < 0) { 		kfree(partdata); 		return err; 	}  	msg_bytes = sparams->msg_bytes; 	pl_size = sparams->pl_size;

Patch:
patch: @@ -572,8 +572,10 @@ static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev,
 	else
 		err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata,
 					       sparams);
-	if (err < 0)
+	if (err < 0) {
+		kfree(partdata);
 		return err;
+	}
 
 	msg_bytes = sparams->msg_bytes;
 	pl_size = sparams->pl_size;
path: sound/soc/sof/ipc.c
Vulnerability: A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef.
Vulnerability ID: CVE-2019-18812
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-07
File: sound/soc/sof/debug.c
Commit message: ASoC: SOF: Fix memory leak in sof_dfsentry_write

In the implementation of sof_dfsentry_write() memory allocated for
string is leaked in case of an error. Go to error handling path if the
d_name.name is not valid.

Fixes: 091c12e1f50c ("ASoC: SOF: debug: add new debugfs entries for IPC flood test")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20191027194856.4056-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer, 	 */ 	dentry = file->f_path.dentry; 	if (strcmp(dentry->d_name.name, "ipc_flood_count") && 	    strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) 		return -EINVAL;  	if (!strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) 		flood_duration_test = true;

Fixed version (after fix):
 static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer, 	 */ 	dentry = file->f_path.dentry; 	if (strcmp(dentry->d_name.name, "ipc_flood_count") && 	    strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) { 		ret = -EINVAL; 		goto out; 	}  	if (!strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) 		flood_duration_test = true;

Patch:
patch: @@ -152,8 +152,10 @@ static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer,
 	 */
 	dentry = file->f_path.dentry;
 	if (strcmp(dentry->d_name.name, "ipc_flood_count") &&
-	    strcmp(dentry->d_name.name, "ipc_flood_duration_ms"))
-		return -EINVAL;
+	    strcmp(dentry->d_name.name, "ipc_flood_duration_ms")) {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	if (!strcmp(dentry->d_name.name, "ipc_flood_duration_ms"))
 		flood_duration_test = true;
path: sound/soc/sof/debug.c
Vulnerability: bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
Vulnerability ID: CVE-2019-18982
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/pimcore/pimcore
Published: 2019-11-15
File: bundles/AdminBundle/Controller/Admin/EmailController.php
Commit message: [Email] Email log: do not allow script/iframe execution in preview window
Commit author: Bernhard Rusch

Vulnerable version (before fix):
 public function showEmailLogAction(Request $request, ?Profiler $profiler)              return new Response('<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><style>body{background-color:#fff;}</style></head><body><pre>' . $templatingEnginePhp->escape($emailLog->getTextLog()) . '</pre></body></html>');         } elseif ($request->get('type') == 'html') {             return new Response($emailLog->getHtmlLog());         } elseif ($request->get('type') == 'params') {             try {                 $params = $this->decodeJson($emailLog->getParams());

Fixed version (after fix):
 public function showEmailLogAction(Request $request, ?Profiler $profiler)              return new Response('<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><style>body{background-color:#fff;}</style></head><body><pre>' . $templatingEnginePhp->escape($emailLog->getTextLog()) . '</pre></body></html>');         } elseif ($request->get('type') == 'html') {             return new Response($emailLog->getHtmlLog(), 200, [                 'Content-Security-Policy' => "default-src 'self'; style-src 'self' 'unsafe-inline'"             ]);         } elseif ($request->get('type') == 'params') {             try {                 $params = $this->decodeJson($emailLog->getParams());

Patch:
patch: @@ -133,7 +133,9 @@ public function showEmailLogAction(Request $request, ?Profiler $profiler)
 
             return new Response('<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><style>body{background-color:#fff;}</style></head><body><pre>' . $templatingEnginePhp->escape($emailLog->getTextLog()) . '</pre></body></html>');
         } elseif ($request->get('type') == 'html') {
-            return new Response($emailLog->getHtmlLog());
+            return new Response($emailLog->getHtmlLog(), 200, [
+                'Content-Security-Policy' => "default-src 'self'; style-src 'self' 'unsafe-inline'"
+            ]);
         } elseif ($request->get('type') == 'params') {
             try {
                 $params = $this->decodeJson($emailLog->getParams());
path: bundles/AdminBundle/Controller/Admin/EmailController.php
Vulnerability: A memory leak in the i40e_setup_macvlans() function in drivers/net/ethernet/intel/i40e/i40e_main.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering i40e_setup_channel() failures, aka CID-27d461333459.
Vulnerability ID: CVE-2019-19043
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ethernet/intel/i40e/i40e_main.c
Commit message: i40e: prevent memory leak in i40e_setup_macvlans

In i40e_setup_macvlans if i40e_setup_channel fails the allocated memory
for ch should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int i40e_setup_macvlans(struct i40e_vsi *vsi, u16 macvlan_cnt, u16 qcnt, 		ch->num_queue_pairs = qcnt; 		if (!i40e_setup_channel(pf, vsi, ch)) { 			ret = -EINVAL; 			goto err_free; 		} 		ch->parent_vsi = vsi;

Fixed version (after fix):
 static int i40e_setup_macvlans(struct i40e_vsi *vsi, u16 macvlan_cnt, u16 qcnt, 		ch->num_queue_pairs = qcnt; 		if (!i40e_setup_channel(pf, vsi, ch)) { 			ret = -EINVAL; 			kfree(ch); 			goto err_free; 		} 		ch->parent_vsi = vsi;

Patch:
patch: @@ -7187,6 +7187,7 @@ static int i40e_setup_macvlans(struct i40e_vsi *vsi, u16 macvlan_cnt, u16 qcnt,
 		ch->num_queue_pairs = qcnt;
 		if (!i40e_setup_channel(pf, vsi, ch)) {
 			ret = -EINVAL;
+			kfree(ch);
 			goto err_free;
 		}
 		ch->parent_vsi = vsi;
path: drivers/net/ethernet/intel/i40e/i40e_main.c
Vulnerability: Two memory leaks in the v3d_submit_cl_ioctl() function in drivers/gpu/drm/v3d/v3d_gem.c in the Linux kernel before 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering kcalloc() or v3d_job_init() failures, aka CID-29cd13cfd762.
Vulnerability ID: CVE-2019-19044
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/gpu/drm/v3d/v3d_gem.c
Commit message: drm/v3d: Fix memory leak in v3d_submit_cl_ioctl

In the impelementation of v3d_submit_cl_ioctl() there are two memory
leaks. One is when allocation for bin fails, and the other is when bin
initialization fails. If kcalloc fails to allocate memory for bin then
render->base should be put. Also, if v3d_job_init() fails to initialize
bin->base then allocated memory for bin should be released.

Fixes: a783a09ee76d ("drm/v3d: Refactor job management.")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20191021185250.26130-1-navid.emamdoost@gmail.com
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 v3d_submit_cl_ioctl(struct drm_device *dev, void *data,  	if (args->bcl_start != args->bcl_end) { 		bin = kcalloc(1, sizeof(*bin), GFP_KERNEL); 		if (!bin) 			return -ENOMEM;  		ret = v3d_job_init(v3d, file_priv, &bin->base, 				   v3d_job_free, args->in_sync_bcl); 		if (ret) { 			v3d_job_put(&render->base); 			return ret; 		} 

Fixed version (after fix):
 v3d_submit_cl_ioctl(struct drm_device *dev, void *data,  	if (args->bcl_start != args->bcl_end) { 		bin = kcalloc(1, sizeof(*bin), GFP_KERNEL); 		if (!bin) { 			v3d_job_put(&render->base); 			return -ENOMEM; 		}  		ret = v3d_job_init(v3d, file_priv, &bin->base, 				   v3d_job_free, args->in_sync_bcl); 		if (ret) { 			v3d_job_put(&render->base); 			kfree(bin); 			return ret; 		} 

Patch:
patch: @@ -557,13 +557,16 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data,
 
 	if (args->bcl_start != args->bcl_end) {
 		bin = kcalloc(1, sizeof(*bin), GFP_KERNEL);
-		if (!bin)
+		if (!bin) {
+			v3d_job_put(&render->base);
 			return -ENOMEM;
+		}
 
 		ret = v3d_job_init(v3d, file_priv, &bin->base,
 				   v3d_job_free, args->in_sync_bcl);
 		if (ret) {
 			v3d_job_put(&render->base);
+			kfree(bin);
 			return ret;
 		}
path: drivers/gpu/drm/v3d/v3d_gem.c
Vulnerability: A memory leak in the mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka CID-c8c2a057fdc7.
Vulnerability ID: CVE-2019-19045
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
Commit message: net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq

In mlx5_fpga_conn_create_cq if mlx5_vector2eqn fails the allocated
memory should be released.

Fixes: 537a50574175 ("net/mlx5: FPGA, Add high-speed connection routines")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size) 	}  	err = mlx5_vector2eqn(mdev, smp_processor_id(), &eqn, &irqn); 	if (err) 		goto err_cqwq;  	cqc = MLX5_ADDR_OF(create_cq_in, in, cq_context); 	MLX5_SET(cqc, cqc, log_cq_size, ilog2(cq_size));

Fixed version (after fix):
 static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size) 	}  	err = mlx5_vector2eqn(mdev, smp_processor_id(), &eqn, &irqn); 	if (err) { 		kvfree(in); 		goto err_cqwq; 	}  	cqc = MLX5_ADDR_OF(create_cq_in, in, cq_context); 	MLX5_SET(cqc, cqc, log_cq_size, ilog2(cq_size));

Patch:
patch: @@ -464,8 +464,10 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size)
 	}
 
 	err = mlx5_vector2eqn(mdev, smp_processor_id(), &eqn, &irqn);
-	if (err)
+	if (err) {
+		kvfree(in);
 		goto err_cqwq;
+	}
 
 	cqc = MLX5_ADDR_OF(create_cq_in, in, cq_context);
 	MLX5_SET(cqc, cqc, log_cq_size, ilog2(cq_size));
path: drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c
Vulnerability: ** DISPUTED ** A memory leak in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering ida_simple_get() failure, aka CID-4aa7afb0ee20. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control this failure at probe time.
Vulnerability ID: CVE-2019-19046
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/char/ipmi/ipmi_msghandler.c
Commit message: ipmi: Fix memory leak in __ipmi_bmc_register

In the impelementation of __ipmi_bmc_register() the allocated memory for
bmc should be released in case ida_simple_get() fails.

Fixes: 68e7e50f195f ("ipmi: Don't use BMC product/dev ids in the BMC name")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Message-Id: <20191021200649.1511-1-navid.emamdoost@gmail.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int __ipmi_bmc_register(struct ipmi_smi *intf, 		bmc->pdev.name = "ipmi_bmc";  		rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL); 		if (rv < 0) 			goto out; 		bmc->pdev.dev.driver = &ipmidriver.driver; 		bmc->pdev.id = rv; 		bmc->pdev.dev.release = release_bmc_device;

Fixed version (after fix):
 static int __ipmi_bmc_register(struct ipmi_smi *intf, 		bmc->pdev.name = "ipmi_bmc";  		rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL); 		if (rv < 0) { 			kfree(bmc); 			goto out; 		}  		bmc->pdev.dev.driver = &ipmidriver.driver; 		bmc->pdev.id = rv; 		bmc->pdev.dev.release = release_bmc_device;

Patch:
patch: @@ -3020,8 +3020,11 @@ static int __ipmi_bmc_register(struct ipmi_smi *intf,
 		bmc->pdev.name = "ipmi_bmc";
 
 		rv = ida_simple_get(&ipmi_bmc_ida, 0, 0, GFP_KERNEL);
-		if (rv < 0)
+		if (rv < 0) {
+			kfree(bmc);
 			goto out;
+		}
+
 		bmc->pdev.dev.driver = &ipmidriver.driver;
 		bmc->pdev.id = rv;
 		bmc->pdev.dev.release = release_bmc_device;
path: drivers/char/ipmi/ipmi_msghandler.c
Vulnerability: A memory leak in the mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c in the Linux kernel before 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering mlx5_crdump_collect() failures, aka CID-c7ed6d0183d5.
Vulnerability ID: CVE-2019-19047
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ethernet/mellanox/mlx5/core/health.c
Commit message: net/mlx5: fix memory leak in mlx5_fw_fatal_reporter_dump

In mlx5_fw_fatal_reporter_dump if mlx5_crdump_collect fails the
allocated memory for cr_data must be released otherwise there will be
memory leak. To fix this, this commit changes the return instruction
into goto error handling.

Fixes: 9b1f29823605 ("net/mlx5: Add support for FW fatal reporter dump")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 mlx5_fw_fatal_reporter_dump(struct devlink_health_reporter *reporter, 		return -ENOMEM; 	err = mlx5_crdump_collect(dev, cr_data); 	if (err) 		return err;  	if (priv_ctx) { 		struct mlx5_fw_reporter_ctx *fw_reporter_ctx = priv_ctx;

Fixed version (after fix):
 mlx5_fw_fatal_reporter_dump(struct devlink_health_reporter *reporter, 		return -ENOMEM; 	err = mlx5_crdump_collect(dev, cr_data); 	if (err) 		goto free_data;  	if (priv_ctx) { 		struct mlx5_fw_reporter_ctx *fw_reporter_ctx = priv_ctx;

Patch:
patch: @@ -572,7 +572,7 @@ mlx5_fw_fatal_reporter_dump(struct devlink_health_reporter *reporter,
 		return -ENOMEM;
 	err = mlx5_crdump_collect(dev, cr_data);
 	if (err)
-		return err;
+		goto free_data;
 
 	if (priv_ctx) {
 		struct mlx5_fw_reporter_ctx *fw_reporter_ctx = priv_ctx;
path: drivers/net/ethernet/mellanox/mlx5/core/health.c