From 8a0f9e557b3d3cf3b532cf8f4629fdb2b1ed9a43 Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:31:59 +0800
Subject: [PATCH] urma: ubcore: free the command buffer when the topo info copy
 fails

ubcore_get_topo_info() allocates the reply buffer with kzalloc() and fills
it from the address supplied by the caller. If that copy fails, for
example because the address is not mapped, the function returns -EPERM
without freeing the buffer.

The command has no GENL_ADMIN_PERM flag, so an unprivileged process can
call it repeatedly and leak one buffer per request. The neighbouring
handlers free the buffer on the same failure.

Free the buffer before returning.

Fixes: 1e4e6c6a19a4 ("ubcore: add genl, netlink and vtp support to ubcore module.")
---
 drivers/ub/urma/ubcore/ubcore_genl_admin.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/ub/urma/ubcore/ubcore_genl_admin.c b/drivers/ub/urma/ubcore/ubcore_genl_admin.c
index 5b49137efb06..ca71f7aff2ed 100644
--- a/drivers/ub/urma/ubcore/ubcore_genl_admin.c
+++ b/drivers/ub/urma/ubcore/ubcore_genl_admin.c
@@ -332,8 +332,11 @@ int ubcore_get_topo_info(struct sk_buff *skb, struct genl_info *info)
 	args_addr = nla_get_u64(info->attrs[UBCORE_HDR_ARGS_ADDR]);
 	ret = ubcore_copy_from_user(arg, (void __user *)(uintptr_t)args_addr,
 				    sizeof(struct ubcore_cmd_topo_info));
-	if (ret != 0)
+	if (ret != 0) {
+		ubcore_log_err("Failed to copy from user.\n");
+		kfree(arg);
 		return -EPERM;
+	}
 	topo_map = ubcore_get_global_topo_map();
 	if (topo_map == NULL) {
 		ubcore_log_err("topo map is empty!\n");
-- 
Gitee