Vulnerability: Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering iwl_pcie_init_fw_sec() or dma_alloc_coherent() failures, aka CID-0f4f199443fa.
Vulnerability ID: CVE-2019-19059
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-11-18
File: drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
Commit message: iwlwifi: pcie: fix memory leaks in iwl_pcie_ctxt_info_gen3_init

In iwl_pcie_ctxt_info_gen3_init there are cases that the allocated dma
memory is leaked in case of error.

DMA memories prph_scratch, prph_info, and ctxt_info_gen3 are allocated
and initialized to be later assigned to trans_pcie. But in any error case
before such assignment the allocated memories should be released.

First of such error cases happens when iwl_pcie_init_fw_sec fails.
Current implementation correctly releases prph_scratch. But in two
sunsequent error cases where dma_alloc_coherent may fail, such
releases are missing.

This commit adds release for prph_scratch when allocation for
prph_info fails, and adds releases for prph_scratch and prph_info when
allocation for ctxt_info_gen3 fails.

Fixes: 2ee824026288 ("iwlwifi: pcie: support context information for 22560 devices")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Commit author: Navid Emamdoost

Vulnerable version (before fix):
 int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,  	/* allocate ucode sections in dram and set addresses */ 	ret = iwl_pcie_init_fw_sec(trans, fw, &prph_scratch->dram); 	if (ret) { 		dma_free_coherent(trans->dev, 				  sizeof(*prph_scratch), 				  prph_scratch, 				  trans_pcie->prph_scratch_dma_addr); 		return ret; 	}  	/* Allocate prph information 	 * currently we don't assign to the prph info anything, but it would get 	 * assigned later */ 	prph_info = dma_alloc_coherent(trans->dev, sizeof(*prph_info), 				       &trans_pcie->prph_info_dma_addr, 				       GFP_KERNEL); 	if (!prph_info) 		return -ENOMEM;  	/* Allocate context info */ 	ctxt_info_gen3 = dma_alloc_coherent(trans->dev, 					    sizeof(*ctxt_info_gen3), 					    &trans_pcie->ctxt_info_dma_addr, 					    GFP_KERNEL); 	if (!ctxt_info_gen3) 		return -ENOMEM;  	ctxt_info_gen3->prph_info_base_addr = 		cpu_to_le64(trans_pcie->prph_info_dma_addr); int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, 		iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);  	return 0; }  void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans)

Fixed version (after fix):
 int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,  	/* allocate ucode sections in dram and set addresses */ 	ret = iwl_pcie_init_fw_sec(trans, fw, &prph_scratch->dram); 	if (ret) 		goto err_free_prph_scratch;   	/* Allocate prph information 	 * currently we don't assign to the prph info anything, but it would get 	 * assigned later */ 	prph_info = dma_alloc_coherent(trans->dev, sizeof(*prph_info), 				       &trans_pcie->prph_info_dma_addr, 				       GFP_KERNEL); 	if (!prph_info) { 		ret = -ENOMEM; 		goto err_free_prph_scratch; 	}  	/* Allocate context info */ 	ctxt_info_gen3 = dma_alloc_coherent(trans->dev, 					    sizeof(*ctxt_info_gen3), 					    &trans_pcie->ctxt_info_dma_addr, 					    GFP_KERNEL); 	if (!ctxt_info_gen3) { 		ret = -ENOMEM; 		goto err_free_prph_info; 	}  	ctxt_info_gen3->prph_info_base_addr = 		cpu_to_le64(trans_pcie->prph_info_dma_addr); int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans, 		iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);  	return 0;  err_free_prph_info: 	dma_free_coherent(trans->dev, 			  sizeof(*prph_info), 			prph_info, 			trans_pcie->prph_info_dma_addr);  err_free_prph_scratch: 	dma_free_coherent(trans->dev, 			  sizeof(*prph_scratch), 			prph_scratch, 			trans_pcie->prph_scratch_dma_addr); 	return ret;  }  void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans)

Patch:
patch: @@ -107,30 +107,30 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
 
 	/* allocate ucode sections in dram and set addresses */
 	ret = iwl_pcie_init_fw_sec(trans, fw, &prph_scratch->dram);
-	if (ret) {
-		dma_free_coherent(trans->dev,
-				  sizeof(*prph_scratch),
-				  prph_scratch,
-				  trans_pcie->prph_scratch_dma_addr);
-		return ret;
-	}
+	if (ret)
+		goto err_free_prph_scratch;
+
 
 	/* Allocate prph information
 	 * currently we don't assign to the prph info anything, but it would get
 	 * assigned later */
 	prph_info = dma_alloc_coherent(trans->dev, sizeof(*prph_info),
 				       &trans_pcie->prph_info_dma_addr,
 				       GFP_KERNEL);
-	if (!prph_info)
-		return -ENOMEM;
+	if (!prph_info) {
+		ret = -ENOMEM;
+		goto err_free_prph_scratch;
+	}
 
 	/* Allocate context info */
 	ctxt_info_gen3 = dma_alloc_coherent(trans->dev,
 					    sizeof(*ctxt_info_gen3),
 					    &trans_pcie->ctxt_info_dma_addr,
 					    GFP_KERNEL);
-	if (!ctxt_info_gen3)
-		return -ENOMEM;
+	if (!ctxt_info_gen3) {
+		ret = -ENOMEM;
+		goto err_free_prph_info;
+	}
 
 	ctxt_info_gen3->prph_info_base_addr =
 		cpu_to_le64(trans_pcie->prph_info_dma_addr);
@@ -186,6 +186,20 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
 		iwl_set_bit(trans, CSR_GP_CNTRL, CSR_AUTO_FUNC_INIT);
 
 	return 0;
+
+err_free_prph_info:
+	dma_free_coherent(trans->dev,
+			  sizeof(*prph_info),
+			prph_info,
+			trans_pcie->prph_info_dma_addr);
+
+err_free_prph_scratch:
+	dma_free_coherent(trans->dev,
+			  sizeof(*prph_scratch),
+			prph_scratch,
+			trans_pcie->prph_scratch_dma_addr);
+	return ret;
+
 }
 
 void iwl_pcie_ctxt_info_gen3_free(struct iwl_trans *trans)
path: drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c