rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering crypto_report_alg() failures, aka CID-ffdde5932042.
Vulnerability ID: CVE-2019-19062
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: crypto/crypto_user_base.c
Commit message: crypto: user - fix memory leak in crypto_report

In crypto_report, a new skb is created via nlmsg_new(). This skb should
be released if crypto_report_alg() fails.

Fixes: a38f7907b926 ("crypto: Add userspace configuration API")
Cc: <stable@vger.kernel.org>
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, drop_alg: 	crypto_mod_put(alg);  	if (err) 		return err;  	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid); }

Fixed version (after fix):
 static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh, drop_alg: 	crypto_mod_put(alg);  	if (err) { 		kfree_skb(skb); 		return err; 	}  	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid); }

Patch:
patch: @@ -213,8 +213,10 @@ static int crypto_report(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
 drop_alg:
 	crypto_mod_put(alg);
 
-	if (err)
+	if (err) {
+		kfree_skb(skb);
 		return err;
+	}
 
 	return nlmsg_unicast(net->crypto_nlsk, skb, NETLINK_CB(in_skb).portid);
 }
path: crypto/crypto_user_base.c
Vulnerability: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.
Vulnerability ID: CVE-2019-19063
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/realtek/rtlwifi/usb.c
Commit message: rtlwifi: prevent memory leak in rtl_usb_probe

In rtl_usb_probe if allocation for usb_data fails the allocated hw
should be released. In addition the allocated rtlpriv->usb_data should
be released on error handling path.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int rtl_usb_probe(struct usb_interface *intf, 	rtlpriv->hw = hw; 	rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32), 				    GFP_KERNEL); 	if (!rtlpriv->usb_data) 		return -ENOMEM;  	/* this spin lock must be initialized early */ 	spin_lock_init(&rtlpriv->locks.usb_lock); int rtl_usb_probe(struct usb_interface *intf, 	_rtl_usb_io_handler_release(hw); 	usb_put_dev(udev); 	complete(&rtlpriv->firmware_loading_complete); 	return -ENODEV; } EXPORT_SYMBOL(rtl_usb_probe);

Fixed version (after fix):
 int rtl_usb_probe(struct usb_interface *intf, 	rtlpriv->hw = hw; 	rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32), 				    GFP_KERNEL); 	if (!rtlpriv->usb_data) { 		ieee80211_free_hw(hw); 		return -ENOMEM; 	}  	/* this spin lock must be initialized early */ 	spin_lock_init(&rtlpriv->locks.usb_lock); int rtl_usb_probe(struct usb_interface *intf, 	_rtl_usb_io_handler_release(hw); 	usb_put_dev(udev); 	complete(&rtlpriv->firmware_loading_complete); 	kfree(rtlpriv->usb_data); 	return -ENODEV; } EXPORT_SYMBOL(rtl_usb_probe);

Patch:
patch: @@ -1021,8 +1021,10 @@ int rtl_usb_probe(struct usb_interface *intf,
 	rtlpriv->hw = hw;
 	rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
 				    GFP_KERNEL);
-	if (!rtlpriv->usb_data)
+	if (!rtlpriv->usb_data) {
+		ieee80211_free_hw(hw);
 		return -ENOMEM;
+	}
 
 	/* this spin lock must be initialized early */
 	spin_lock_init(&rtlpriv->locks.usb_lock);
@@ -1083,6 +1085,7 @@ int rtl_usb_probe(struct usb_interface *intf,
 	_rtl_usb_io_handler_release(hw);
 	usb_put_dev(udev);
 	complete(&rtlpriv->firmware_loading_complete);
+	kfree(rtlpriv->usb_data);
 	return -ENODEV;
 }
 EXPORT_SYMBOL(rtl_usb_probe);
path: drivers/net/wireless/realtek/rtlwifi/usb.c
Vulnerability: ** DISPUTED ** A memory leak in the fsl_lpspi_probe() function in drivers/spi/spi-fsl-lpspi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering pm_runtime_get_sync() failures, aka CID-057b8945f78f. NOTE: third parties dispute the relevance of this because an attacker cannot realistically control these failures at probe time.
Vulnerability ID: CVE-2019-19064
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/spi/spi-fsl-lpspi.c
Commit message: spi: lpspi: fix memory leak in fsl_lpspi_probe

In fsl_lpspi_probe an SPI controller is allocated either via
spi_alloc_slave or spi_alloc_master. In all but one error cases this
controller is put by going to error handling code. This commit fixes the
case when pm_runtime_get_sync fails and it should go to the error
handling path.

Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190930034602.1467-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int fsl_lpspi_probe(struct platform_device *pdev) 	ret = pm_runtime_get_sync(fsl_lpspi->dev); 	if (ret < 0) { 		dev_err(fsl_lpspi->dev, "failed to enable clock\n"); 		return ret; 	}  	temp = readl(fsl_lpspi->base + IMX7ULP_PARAM);

Fixed version (after fix):
 static int fsl_lpspi_probe(struct platform_device *pdev) 	ret = pm_runtime_get_sync(fsl_lpspi->dev); 	if (ret < 0) { 		dev_err(fsl_lpspi->dev, "failed to enable clock\n"); 		goto out_controller_put; 	}  	temp = readl(fsl_lpspi->base + IMX7ULP_PARAM);

Patch:
patch: @@ -938,7 +938,7 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
 	ret = pm_runtime_get_sync(fsl_lpspi->dev);
 	if (ret < 0) {
 		dev_err(fsl_lpspi->dev, "failed to enable clock\n");
-		return ret;
+		goto out_controller_put;
 	}
 
 	temp = readl(fsl_lpspi->base + IMX7ULP_PARAM);
path: drivers/spi/spi-fsl-lpspi.c
Vulnerability: ** DISPUTED ** A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering rhashtable_init() failures, aka CID-34b3be18a04e. NOTE: This has been disputed as not a vulnerability because "rhashtable_init() can only fail if it is passed invalid values in the second parameter's struct, but when invoked from sdma_init() that is a pointer to a static const struct, so an attacker could only trigger failure if they could corrupt kernel memory (in which case a small memory leak is not a significant problem)."
Vulnerability ID: CVE-2019-19065
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/infiniband/hw/hfi1/sdma.c
Commit message: RDMA/hfi1: Prevent memory leak in sdma_init

In sdma_init if rhashtable_init fails the allocated memory for
tmp_sdma_rht should be released.

Fixes: 5a52a7acf7e2 ("IB/hfi1: NULL pointer dereference when freeing rhashtable")
Link: https://lore.kernel.org/r/20190925144543.10141-1-navid.emamdoost@gmail.com
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Acked-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int sdma_init(struct hfi1_devdata *dd, u8 port) 	}  	ret = rhashtable_init(tmp_sdma_rht, &sdma_rht_params); 	if (ret < 0) 		goto bail; 	dd->sdma_rht = tmp_sdma_rht;  	dd_dev_info(dd, "SDMA num_sdma: %u\n", dd->num_sdma);

Fixed version (after fix):
 int sdma_init(struct hfi1_devdata *dd, u8 port) 	}  	ret = rhashtable_init(tmp_sdma_rht, &sdma_rht_params); 	if (ret < 0) { 		kfree(tmp_sdma_rht); 		goto bail; 	}  	dd->sdma_rht = tmp_sdma_rht;  	dd_dev_info(dd, "SDMA num_sdma: %u\n", dd->num_sdma);

Patch:
patch: @@ -1526,8 +1526,11 @@ int sdma_init(struct hfi1_devdata *dd, u8 port)
 	}
 
 	ret = rhashtable_init(tmp_sdma_rht, &sdma_rht_params);
-	if (ret < 0)
+	if (ret < 0) {
+		kfree(tmp_sdma_rht);
 		goto bail;
+	}
+
 	dd->sdma_rht = tmp_sdma_rht;
 
 	dd_dev_info(dd, "SDMA num_sdma: %u\n", dd->num_sdma);
path: drivers/infiniband/hw/hfi1/sdma.c
Vulnerability: A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.
Vulnerability ID: CVE-2019-19066
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/scsi/bfa/bfad_attr.c
Commit message: scsi: bfa: release allocated memory in case of error

In bfad_im_get_stats if bfa_port_get_stats fails, allocated memory needs to
be released.

Link: https://lore.kernel.org/r/20190910234417.22151-1-navid.emamdoost@gmail.com
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 bfad_im_get_stats(struct Scsi_Host *shost) 	rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), 				fcstats, bfad_hcb_comp, &fcomp); 	spin_unlock_irqrestore(&bfad->bfad_lock, flags); 	if (rc != BFA_STATUS_OK) 		return NULL;  	wait_for_completion(&fcomp.comp); 

Fixed version (after fix):
 bfad_im_get_stats(struct Scsi_Host *shost) 	rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa), 				fcstats, bfad_hcb_comp, &fcomp); 	spin_unlock_irqrestore(&bfad->bfad_lock, flags); 	if (rc != BFA_STATUS_OK) { 		kfree(fcstats); 		return NULL; 	}  	wait_for_completion(&fcomp.comp); 

Patch:
patch: @@ -275,8 +275,10 @@ bfad_im_get_stats(struct Scsi_Host *shost)
 	rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa),
 				fcstats, bfad_hcb_comp, &fcomp);
 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
-	if (rc != BFA_STATUS_OK)
+	if (rc != BFA_STATUS_OK) {
+		kfree(fcstats);
 		return NULL;
+	}
 
 	wait_for_completion(&fcomp.comp);
path: drivers/scsi/bfa/bfad_attr.c
Vulnerability: A memory leak in the rtl8xxxu_submit_int_urb() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-a2cdd07488e6.
Vulnerability ID: CVE-2019-19068
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
Commit message: rtl8xxxu: prevent leaking urb

In rtl8xxxu_submit_int_urb if usb_submit_urb fails the allocated urb
should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Reviewed-by: Chris Chiu <chiu@endlessm.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) 	ret = usb_submit_urb(urb, GFP_KERNEL); 	if (ret) { 		usb_unanchor_urb(urb); 		goto error; 	} 

Fixed version (after fix):
 static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) 	ret = usb_submit_urb(urb, GFP_KERNEL); 	if (ret) { 		usb_unanchor_urb(urb); 		usb_free_urb(urb); 		goto error; 	} 

Patch:
patch: @@ -5444,6 +5444,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
 	ret = usb_submit_urb(urb, GFP_KERNEL);
 	if (ret) {
 		usb_unanchor_urb(urb);
+		usb_free_urb(urb);
 		goto error;
 	}
path: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
Vulnerability: A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99.
Vulnerability ID: CVE-2019-19069
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/misc/fastrpc.c
Commit message: misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach

In fastrpc_dma_buf_attach if dma_get_sgtable fails the allocated memory
for a should be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190925152742.16258-1-navid.emamdoost@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int fastrpc_dma_buf_attach(struct dma_buf *dmabuf, 			      FASTRPC_PHYS(buffer->phys), buffer->size); 	if (ret < 0) { 		dev_err(buffer->dev, "failed to get scatterlist from DMA API\n"); 		return -EINVAL; 	} 

Fixed version (after fix):
 static int fastrpc_dma_buf_attach(struct dma_buf *dmabuf, 			      FASTRPC_PHYS(buffer->phys), buffer->size); 	if (ret < 0) { 		dev_err(buffer->dev, "failed to get scatterlist from DMA API\n"); 		kfree(a); 		return -EINVAL; 	} 

Patch:
patch: @@ -527,6 +527,7 @@ static int fastrpc_dma_buf_attach(struct dma_buf *dmabuf,
 			      FASTRPC_PHYS(buffer->phys), buffer->size);
 	if (ret < 0) {
 		dev_err(buffer->dev, "failed to get scatterlist from DMA API\n");
+		kfree(a);
 		return -EINVAL;
 	}
path: drivers/misc/fastrpc.c
Vulnerability: ** DISPUTED ** A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering devm_add_action_or_reset() failures, aka CID-d3b0ffa1d75d. NOTE: third parties dispute the relevance of this because the system must have already been out of memory before the probe began.
Vulnerability ID: CVE-2019-19070
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/spi/spi-gpio.c
Commit message: spi: gpio: prevent memory leak in spi_gpio_probe

In spi_gpio_probe an SPI master is allocated via spi_alloc_master, but
this controller should be released if devm_add_action_or_reset fails,
otherwise memory leaks. In order to avoid leak spi_contriller_put must
be called in case of failure for devm_add_action_or_reset.

Fixes: 8b797490b4db ("spi: gpio: Make sure spi_master_put() is called in every error path")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190930205241.5483-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int spi_gpio_probe(struct platform_device *pdev) 		return -ENOMEM;  	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master); 	if (status) 		return status;  	if (of_id) 		status = spi_gpio_probe_dt(pdev, master);

Fixed version (after fix):
 static int spi_gpio_probe(struct platform_device *pdev) 		return -ENOMEM;  	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master); 	if (status) { 		spi_master_put(master); 		return status; 	}  	if (of_id) 		status = spi_gpio_probe_dt(pdev, master);

Patch:
patch: @@ -371,8 +371,10 @@ static int spi_gpio_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master);
-	if (status)
+	if (status) {
+		spi_master_put(master);
 		return status;
+	}
 
 	if (of_id)
 		status = spi_gpio_probe_dt(pdev, master);
path: drivers/spi/spi-gpio.c
Vulnerability: A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
Vulnerability ID: CVE-2019-19071
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/rsi/rsi_91x_mgmt.c
Commit message: rsi: release skb if rsi_prepare_beacon fails

In rsi_send_beacon, if rsi_prepare_beacon fails the allocated skb should
be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int rsi_send_beacon(struct rsi_common *common) 		skb_pull(skb, (64 - dword_align_bytes)); 	if (rsi_prepare_beacon(common, skb)) { 		rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n"); 		return -EINVAL; 	} 	skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb);

Fixed version (after fix):
 static int rsi_send_beacon(struct rsi_common *common) 		skb_pull(skb, (64 - dword_align_bytes)); 	if (rsi_prepare_beacon(common, skb)) { 		rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n"); 		dev_kfree_skb(skb); 		return -EINVAL; 	} 	skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb);

Patch:
patch: @@ -1756,6 +1756,7 @@ static int rsi_send_beacon(struct rsi_common *common)
 		skb_pull(skb, (64 - dword_align_bytes));
 	if (rsi_prepare_beacon(common, skb)) {
 		rsi_dbg(ERR_ZONE, "Failed to prepare beacon\n");
+		dev_kfree_skb(skb);
 		return -EINVAL;
 	}
 	skb_queue_tail(&common->tx_queue[MGMT_BEACON_Q], skb);
path: drivers/net/wireless/rsi/rsi_91x_mgmt.c
Vulnerability: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
Vulnerability ID: CVE-2019-19072
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: kernel/trace/trace_events_filter.c
Commit message: tracing: Have error path in predicate_parse() free its allocated memory

In predicate_parse, there is an error path that is not going to
out_free instead it returns directly which leads to a memory leak.

Link: http://lkml.kernel.org/r/20190920225800.3870-1-navid.emamdoost@gmail.com

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 predicate_parse(const char *str, int nr_parens, int nr_preds,  		switch (*next) { 		case '(':					/* #2 */ 			if (top - op_stack > nr_parens) 				return ERR_PTR(-EINVAL); 			*(++top) = invert; 			continue; 		case '!':					/* #3 */

Fixed version (after fix):
 predicate_parse(const char *str, int nr_parens, int nr_preds,  		switch (*next) { 		case '(':					/* #2 */ 			if (top - op_stack > nr_parens) { 				ret = -EINVAL; 				goto out_free; 			} 			*(++top) = invert; 			continue; 		case '!':					/* #3 */

Patch:
patch: @@ -452,8 +452,10 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,
 
 		switch (*next) {
 		case '(':					/* #2 */
-			if (top - op_stack > nr_parens)
-				return ERR_PTR(-EINVAL);
+			if (top - op_stack > nr_parens) {
+				ret = -EINVAL;
+				goto out_free;
+			}
 			*(++top) = invert;
 			continue;
 		case '!':					/* #3 */
path: kernel/trace/trace_events_filter.c
Vulnerability: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, and the htc_connect_service() function, aka CID-853acf7caf10.
Vulnerability ID: CVE-2019-19073
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/ath/ath9k/htc_hst.c
Commit message: ath9k_htc: release allocated buffer if timed out

In htc_config_pipe_credits, htc_setup_complete, and htc_connect_service
if time out happens, the allocated buffer needs to be released.
Otherwise there will be memory leak.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 static int htc_config_pipe_credits(struct htc_target *target) 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); 	if (!time_left) { 		dev_err(target->dev, "HTC credit config timeout\n"); 		return -ETIMEDOUT; 	}  static int htc_setup_complete(struct htc_target *target) 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); 	if (!time_left) { 		dev_err(target->dev, "HTC start timeout\n"); 		return -ETIMEDOUT; 	}  int htc_connect_service(struct htc_target *target, 	if (!time_left) { 		dev_err(target->dev, "Service connection timeout for: %d\n", 			service_connreq->service_id); 		return -ETIMEDOUT; 	} 

Fixed version (after fix):
 static int htc_config_pipe_credits(struct htc_target *target) 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); 	if (!time_left) { 		dev_err(target->dev, "HTC credit config timeout\n"); 		kfree_skb(skb); 		return -ETIMEDOUT; 	}  static int htc_setup_complete(struct htc_target *target) 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ); 	if (!time_left) { 		dev_err(target->dev, "HTC start timeout\n"); 		kfree_skb(skb); 		return -ETIMEDOUT; 	}  int htc_connect_service(struct htc_target *target, 	if (!time_left) { 		dev_err(target->dev, "Service connection timeout for: %d\n", 			service_connreq->service_id); 		kfree_skb(skb); 		return -ETIMEDOUT; 	} 

Patch:
patch: @@ -170,6 +170,7 @@ static int htc_config_pipe_credits(struct htc_target *target)
 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
 	if (!time_left) {
 		dev_err(target->dev, "HTC credit config timeout\n");
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 
@@ -205,6 +206,7 @@ static int htc_setup_complete(struct htc_target *target)
 	time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
 	if (!time_left) {
 		dev_err(target->dev, "HTC start timeout\n");
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
 
@@ -277,6 +279,7 @@ int htc_connect_service(struct htc_target *target,
 	if (!time_left) {
 		dev_err(target->dev, "Service connection timeout for: %d\n",
 			service_connreq->service_id);
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
path: drivers/net/wireless/ath/ath9k/htc_hst.c
Vulnerability: A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
Vulnerability ID: CVE-2019-19074
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/ath/ath9k/wmi.c
Commit message: ath9k: release allocated buffer if timed out

In ath9k_wmi_cmd, the allocated network buffer needs to be released
if timeout happens. Otherwise memory will be leaked.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, 		ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", 			wmi_cmd_to_name(cmd_id)); 		mutex_unlock(&wmi->op_mutex); 		return -ETIMEDOUT; 	} 

Fixed version (after fix):
 int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, 		ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", 			wmi_cmd_to_name(cmd_id)); 		mutex_unlock(&wmi->op_mutex); 		kfree_skb(skb); 		return -ETIMEDOUT; 	} 

Patch:
patch: @@ -336,6 +336,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
 		ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
 			wmi_cmd_to_name(cmd_id));
 		mutex_unlock(&wmi->op_mutex);
+		kfree_skb(skb);
 		return -ETIMEDOUT;
 	}
path: drivers/net/wireless/ath/ath9k/wmi.c