Fix a bunch of CVEs

1 files changed, 110 insertions, 0 deletions

diff --git a/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch b/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch
new file mode 100644
index 000000000..69d1c0f46
--- /dev/null
+++ b/rtlwifi-prevent-memory-leak-in-rtl_usb_probe.patch
@@ -0,0 +1,110 @@
+From patchwork Wed Sep 25 01:20:21 2019
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Navid Emamdoost <navid.emamdoost@gmail.com>
+X-Patchwork-Id: 1131161
+Return-Path: <SRS0=wETr=XU=vger.kernel.org=linux-kernel-owner@kernel.org>
+Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id BC591C432C1
+	for <linux-kernel@archiver.kernel.org>; Wed, 25 Sep 2019 01:20:44 +0000 (UTC)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by mail.kernel.org (Postfix) with ESMTP id 8BCDC2146E
+	for <linux-kernel@archiver.kernel.org>; Wed, 25 Sep 2019 01:20:44 +0000 (UTC)
+Authentication-Results: mail.kernel.org;
+	dkim=fail reason="signature verification failed" (2048-bit key)
+ header.d=gmail.com header.i=@gmail.com header.b="SWiOz5xt"
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S2411353AbfIYBUn (ORCPT
+        <rfc822;linux-kernel@archiver.kernel.org>);
+        Tue, 24 Sep 2019 21:20:43 -0400
+Received: from mail-io1-f68.google.com ([209.85.166.68]:33885 "EHLO
+        mail-io1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S2392379AbfIYBUn (ORCPT
+        <rfc822;linux-kernel@vger.kernel.org>);
+        Tue, 24 Sep 2019 21:20:43 -0400
+Received: by mail-io1-f68.google.com with SMTP id q1so9351551ion.1;
+        Tue, 24 Sep 2019 18:20:42 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20161025;
+        h=from:to:cc:subject:date:message-id;
+        bh=mQUUiLblrejWrKd0KlOdzOcENXF40rH5GYEM9TuaSS4=;
+        b=SWiOz5xtaFHfAe7qhrZOfB3XaTTABaRoUA2WkntQTu6mZLAPtLqltcn1HSz4FOVdmc
+         C4hiQS6HxKitVmGPHJR6BnOiAdmb8p/ke41JsAiVtxDyJj/EtgPgcn000LqwSw2XXpRs
+         aJsehFF9sM31eMjJ3jPJMVhf1moysCBTI8rG+6ARu4tg//7sLz/cZpWsKuTFtLA41S2X
+         Moj049CPHidyuiCC+TLFAA4dTAVT1wk5YorB1e+xMSVKHkW4g3k4FuVp38c12CmbT13R
+         wsO2tqJ0iRFy2a/3SfO203+i0XYenfEQ/WWVu5ywTPrwX422oKO4PeywgDE5pL7ILA7N
+         5lXA==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20161025;
+        h=x-gm-message-state:from:to:cc:subject:date:message-id;
+        bh=mQUUiLblrejWrKd0KlOdzOcENXF40rH5GYEM9TuaSS4=;
+        b=PVpA/fyBIdoLH3ctyZntsZiwJLKRkFCP/mefxIVWehzdNs+J01dhg9UvthHik8uSD0
+         WAfXOKljH2T6Dz6LC8B/araiwV5iwm9zy3h1VlfLlervg6lYtMtGN8XfNFJccvIcoFIf
+         0rOQal8NWpkvib3lEqdVdolhDogapBQWxjPQApj9tuYkO3JWOpr994A5Legt0Ha/Mdpg
+         iLum0KUzciv2wLRhPIGTis08rgOJQbuV/lWNmEkCqbS6tSlvN/HH7apJEJU+Xm1vfhqB
+         SB2zOsviArNFeNhb/VpZyY329Au5/aGwh06J3nI6xfxyUSWEDCs24g1LN/PL7ESZvquK
+         +kzg==
+X-Gm-Message-State: APjAAAWn+51fVnTld2M5xyo/OXfdxePecAEGRlXft7qNHI0Gnp9EyVgR
+        otCkul6uMkwDI6M6UjbBXIo20ZwJqcc=
+X-Google-Smtp-Source: 
+ APXvYqwYH0op/7MmCPiM8xAfMsxn7k8FX5LrV/HLNynk01ydo/cjks9o5mJOS8EhqcleAu7Y+qfNeQ==
+X-Received: by 2002:a02:5ec4:: with SMTP id
+ h187mr2345350jab.101.1569374442036;
+        Tue, 24 Sep 2019 18:20:42 -0700 (PDT)
+Received: from cs-dulles.cs.umn.edu (cs-dulles.cs.umn.edu. [128.101.35.54])
+        by smtp.googlemail.com with ESMTPSA id
+ r12sm28225ilq.70.2019.09.24.18.20.41
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Tue, 24 Sep 2019 18:20:41 -0700 (PDT)
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Cc: emamd001@umn.edu, smccaman@umn.edu, kjlu@umn.edu,
+        Navid Emamdoost <navid.emamdoost@gmail.com>,
+        Ping-Ke Shih <pkshih@realtek.com>,
+        Kalle Valo <kvalo@codeaurora.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
+        linux-kernel@vger.kernel.org
+Subject: [PATCH] rtlwifi: prevent memory leak in rtl_usb_probe
+Date: Tue, 24 Sep 2019 20:20:21 -0500
+Message-Id: <20190925012022.13727-1-navid.emamdoost@gmail.com>
+X-Mailer: git-send-email 2.17.1
+To: unlisted-recipients:; (no To-header on input)
+Sender: linux-kernel-owner@vger.kernel.org
+Precedence: bulk
+List-ID: <linux-kernel.vger.kernel.org>
+X-Mailing-List: linux-kernel@vger.kernel.org
+
+In rtl_usb_probe if allocation for usb_data fails the allocated hw
+should be released. In addition the allocated rtlpriv->usb_data should
+be released on error handling path.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 4b59f3b46b28..348b0072cdd6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1021,8 +1021,10 @@ int rtl_usb_probe(struct usb_interface *intf,
+ 	rtlpriv->hw = hw;
+ 	rtlpriv->usb_data = kcalloc(RTL_USB_MAX_RX_COUNT, sizeof(u32),
+ 				    GFP_KERNEL);
+-	if (!rtlpriv->usb_data)
++	if (!rtlpriv->usb_data) {
++		ieee80211_free_hw(hw);
+ 		return -ENOMEM;
++	}
+ 
+ 	/* this spin lock must be initialized early */
+ 	spin_lock_init(&rtlpriv->locks.usb_lock);
+@@ -1083,6 +1085,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+ 	_rtl_usb_io_handler_release(hw);
+ 	usb_put_dev(udev);
+ 	complete(&rtlpriv->firmware_loading_complete);
++	kfree(rtlpriv->usb_data);
+ 	return -ENODEV;
+ }
+ EXPORT_SYMBOL(rtl_usb_probe);