| Message ID | 20210302163446.21047-1-colin.king@canonical.com |
|---|---|
| State | Accepted |
| Commit | 98b5ef3e97b16eaeeedb936f8bda3594ff84a70e |
| Headers | show |
| Series | crypto: sun8i-ss: Fix memory leak of object d when dma_iv fails to map | expand |
Le Tue, Mar 02, 2021 at 04:34:46PM +0000, Colin King a écrit : > From: Colin Ian King <colin.king@canonical.com> > > In the case where the dma_iv mapping fails, the return error path leaks > the memory allocated to object d. Fix this by adding a new error return > label and jumping to this to ensure d is free'd before the return. > > Addresses-Coverity: ("Resource leak") > Fixes: ac2614d721de ("crypto: sun8i-ss - Add support for the PRNG") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c > index 08a1473b2145..3191527928e4 100644 > --- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c > +++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c > @@ -103,7 +103,8 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src, > dma_iv = dma_map_single(ss->dev, ctx->seed, ctx->slen, DMA_TO_DEVICE); > if (dma_mapping_error(ss->dev, dma_iv)) { > dev_err(ss->dev, "Cannot DMA MAP IV\n"); > - return -EFAULT; > + err = -EFAULT; > + goto err_free; > } > > dma_dst = dma_map_single(ss->dev, d, todo, DMA_FROM_DEVICE); > @@ -167,6 +168,7 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src, > memcpy(ctx->seed, d + dlen, ctx->slen); > } > memzero_explicit(d, todo); > +err_free: > kfree(d); > > return err; > -- > 2.30.0 > Hello Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com> Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com> Thanks
On Tue, Mar 02, 2021 at 04:34:46PM +0000, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > In the case where the dma_iv mapping fails, the return error path leaks > the memory allocated to object d. Fix this by adding a new error return > label and jumping to this to ensure d is free'd before the return. > > Addresses-Coverity: ("Resource leak") > Fixes: ac2614d721de ("crypto: sun8i-ss - Add support for the PRNG") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Patch applied. Thanks. -- Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c index 08a1473b2145..3191527928e4 100644 --- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c +++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c @@ -103,7 +103,8 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src, dma_iv = dma_map_single(ss->dev, ctx->seed, ctx->slen, DMA_TO_DEVICE); if (dma_mapping_error(ss->dev, dma_iv)) { dev_err(ss->dev, "Cannot DMA MAP IV\n"); - return -EFAULT; + err = -EFAULT; + goto err_free; } dma_dst = dma_map_single(ss->dev, d, todo, DMA_FROM_DEVICE); @@ -167,6 +168,7 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src, memcpy(ctx->seed, d + dlen, ctx->slen); } memzero_explicit(d, todo); +err_free: kfree(d); return err;