From 6b52ce7054fa148cc8fb8d4f89ad922f4a271c18 Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:32:40 +0800
Subject: [PATCH] urma: ubcore: free the udata exchange buffer on the ue index
 error path

ubcore_connect_exchange_udata_when_import_seg() and its jetty counterpart
allocate a BONDING_UDATA_BUF_LEN (1928 bytes) buffer before looking at the
caller supplied ue index. When ubcore_get_bonding_ue_idx_from_udata()
rejects the udata - missing udrv_data, in_addr or in_len smaller than the
index size, or an unreadable in_addr - both functions return straight
away and leak the buffer.

The udata is built from the userspace import request, so a caller can
repeat the request with a bad in_addr and leak 1928 bytes per call. The
next error branch in both functions already jumps to the free_buf label;
do the same here.

Fixes: fd10fa32a4c6 ("urma: use user-specified ue_idx for bonding import exchange")
---
 drivers/ub/urma/ubcore/ubcore_connect_bonding.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/ub/urma/ubcore/ubcore_connect_bonding.c b/drivers/ub/urma/ubcore/ubcore_connect_bonding.c
index 0cf54557cfa9..bae7c1b31176 100644
--- a/drivers/ub/urma/ubcore/ubcore_connect_bonding.c
+++ b/drivers/ub/urma/ubcore/ubcore_connect_bonding.c
@@ -438,7 +438,7 @@ int ubcore_connect_exchange_udata_when_import_seg(struct ubcore_seg *seg,
 
 	ret = ubcore_get_bonding_ue_idx_from_udata(udata, &ue_idx);
 	if (ret != 0)
-		return ret;
+		goto free_buf;
 
 	physical_dev = ubcore_find_physical_device(dev, ue_idx);
 	if (!physical_dev) {
@@ -523,7 +523,7 @@ int ubcore_connect_exchange_udata_when_import_jetty(
 
 	ret = ubcore_get_bonding_ue_idx_from_udata(udata, &ue_idx);
 	if (ret != 0)
-		return ret;
+		goto free_buf;
 
 	physical_dev = ubcore_find_physical_device(dev, ue_idx);
 	if (!physical_dev) {
-- 
Gitee