Vulnerability: ** DISPUTED ** A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux kernel before 5.3.6 allows attackers to cause a denial of service (memory consumption), aka CID-78beef629fd9. NOTE: This has been argued as not a valid vulnerability. The upstream commit 78beef629fd9 was reverted.
Vulnerability ID: CVE-2019-19076
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/ethernet/netronome/nfp/abm/cls.c
Commit message: nfp: abm: fix memory leak in nfp_abm_u32_knode_replace

In nfp_abm_u32_knode_replace if the allocation for match fails it should
go to the error handling instead of returning. Updated other gotos to
have correct errno returned, too.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, 	u8 mask, val; 	int err;  	if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) 		goto err_delete;  	tos_off = proto == htons(ETH_P_IP) ? 16 : 20;  nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, 		if ((iter->val & cmask) == (val & cmask) && 		    iter->band != knode->res->classid) { 			NL_SET_ERR_MSG_MOD(extack, "conflict with already offloaded filter"); 			goto err_delete; 		} 	}  	if (!match) { 		match = kzalloc(sizeof(*match), GFP_KERNEL); 		if (!match) 			return -ENOMEM; 		list_add(&match->list, &alink->dscp_map); 	} 	match->handle = knode->handle; nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,  err_delete: 	nfp_abm_u32_knode_delete(alink, knode); 	return -EOPNOTSUPP; }  static int nfp_abm_setup_tc_block_cb(enum tc_setup_type type,

Fixed version (after fix):
 nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, 	u8 mask, val; 	int err;  	if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) { 		err = -EOPNOTSUPP; 		goto err_delete; 	}  	tos_off = proto == htons(ETH_P_IP) ? 16 : 20;  nfp_abm_u32_knode_replace(struct nfp_abm_link *alink, 		if ((iter->val & cmask) == (val & cmask) && 		    iter->band != knode->res->classid) { 			NL_SET_ERR_MSG_MOD(extack, "conflict with already offloaded filter"); 			err = -EOPNOTSUPP; 			goto err_delete; 		} 	}  	if (!match) { 		match = kzalloc(sizeof(*match), GFP_KERNEL); 		if (!match) { 			err = -ENOMEM; 			goto err_delete; 		}  		list_add(&match->list, &alink->dscp_map); 	} 	match->handle = knode->handle; nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,  err_delete: 	nfp_abm_u32_knode_delete(alink, knode); 	return err; }  static int nfp_abm_setup_tc_block_cb(enum tc_setup_type type,

Patch:
patch: @@ -176,8 +176,10 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
 	u8 mask, val;
 	int err;
 
-	if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack))
+	if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) {
+		err = -EOPNOTSUPP;
 		goto err_delete;
+	}
 
 	tos_off = proto == htons(ETH_P_IP) ? 16 : 20;
 
@@ -198,14 +200,18 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
 		if ((iter->val & cmask) == (val & cmask) &&
 		    iter->band != knode->res->classid) {
 			NL_SET_ERR_MSG_MOD(extack, "conflict with already offloaded filter");
+			err = -EOPNOTSUPP;
 			goto err_delete;
 		}
 	}
 
 	if (!match) {
 		match = kzalloc(sizeof(*match), GFP_KERNEL);
-		if (!match)
-			return -ENOMEM;
+		if (!match) {
+			err = -ENOMEM;
+			goto err_delete;
+		}
+
 		list_add(&match->list, &alink->dscp_map);
 	}
 	match->handle = knode->handle;
@@ -221,7 +227,7 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
 
 err_delete:
 	nfp_abm_u32_knode_delete(alink, knode);
-	return -EOPNOTSUPP;
+	return err;
 }
 
 static int nfp_abm_setup_tc_block_cb(enum tc_setup_type type,
path: drivers/net/ethernet/netronome/nfp/abm/cls.c