Messages in this thread | | | Date | Sat, 11 Jun 2022 10:38:07 +0800 | Subject | Re: [PATCH -next] Revert "evm: Fix memleak in init_desc" | From | "Guozihua (Scott)" <> |
| |
On 2022/6/10 22:20, Mimi Zohar wrote: > On Fri, 2022-05-27 at 19:17 +0800, Xiu Jianfeng wrote: >> This reverts commit ccf11dbaa07b328fa469415c362d33459c140a37. >> >> Commit ccf11dbaa07b ("evm: Fix memleak in init_desc") said there is >> memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is >> saved in one of the two global variables hmac_tfm ohr evm_tfm[hash_algo], >> then if init_desc is called next time, there is no need to alloc tfm >> again, so in the error path of kmalloc desc or crypto_shash_init(desc), >> It is not a problem without freeing tmp_tfm. >> >> And also that commit did not reset the global variable to NULL after >> freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a >> UAF issue. >> >> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> > > Agreed, thanks. This was first reported by Guozihua (Scott) < > guozihua@huawei.com>. If neither you nor Scott object, I'll add his > Reported-by tag. > > thanks, > > Mimi > > .
Good for me.
-- Best GUO Zihua
| |