lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 172/717] crypto: sun8i-ce - fix two error paths memory leak
    Date
    From: Corentin Labbe <clabbe@baylibre.com>

    [ Upstream commit 732b764099f651a088fd931d7b8121b6aa84e62e ]

    This patch fixes the following smatch warnings:
    drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c:412
    sun8i_ce_hash_run() warn: possible memory leak of 'result'
    Note: "buf" is leaked as well.

    Furthermore, in case of ENOMEM, crypto_finalize_hash_request() was not
    called which was an error.

    Fixes: 56f6d5aee88d ("crypto: sun8i-ce - support hash algorithms")
    Reported-by: kernel test robot <lkp@intel.com>
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    .../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 20 +++++++++++--------
    1 file changed, 12 insertions(+), 8 deletions(-)

    diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
    index a94bf28f858a7..4c5a2c11d7141 100644
    --- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
    +++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
    @@ -262,13 +262,13 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
    u32 common;
    u64 byte_count;
    __le32 *bf;
    - void *buf;
    + void *buf = NULL;
    int j, i, todo;
    int nbw = 0;
    u64 fill, min_fill;
    __be64 *bebits;
    __le64 *lebits;
    - void *result;
    + void *result = NULL;
    u64 bs;
    int digestsize;
    dma_addr_t addr_res, addr_pad;
    @@ -285,13 +285,17 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)

    /* the padding could be up to two block. */
    buf = kzalloc(bs * 2, GFP_KERNEL | GFP_DMA);
    - if (!buf)
    - return -ENOMEM;
    + if (!buf) {
    + err = -ENOMEM;
    + goto theend;
    + }
    bf = (__le32 *)buf;

    result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
    - if (!result)
    - return -ENOMEM;
    + if (!result) {
    + err = -ENOMEM;
    + goto theend;
    + }

    flow = rctx->flow;
    chan = &ce->chanlist[flow];
    @@ -403,11 +407,11 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
    dma_unmap_sg(ce->dev, areq->src, nr_sgs, DMA_TO_DEVICE);
    dma_unmap_single(ce->dev, addr_res, digestsize, DMA_FROM_DEVICE);

    - kfree(buf);

    memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
    - kfree(result);
    theend:
    + kfree(buf);
    + kfree(result);
    crypto_finalize_hash_request(engine, breq, err);
    return 0;
    }
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 16:12    [W:2.379 / U:0.312 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site