linux-kernel - Re: [PATCH][next] staging: ccree: fix memory leaks in cc_ivgen

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 22 Jan 2018 09:13:48 +0200
From:   Gilad Ben-Yossef <gilad@...yossef.com>
To:     Colin King <colin.king@...onical.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Crypto Mailing List <linux-crypto@...r.kernel.org>,
        driverdev-devel@...uxdriverproject.org, devel@...verdev.osuosl.org,
        kernel-janitors@...r.kernel.org,
        Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH][next] staging: ccree: fix memory leaks in cc_ivgen_init

On Fri, Jan 12, 2018 at 6:10 PM, Colin King <colin.king@...onical.com> wrote:
> From: Colin Ian King <colin.king@...onical.com>
>
> The current error exit path in function cc_ivgen_init via label
> 'out' free's resources from the drvdata->ivgen_handle context.
> However, drvdata->ivgen_handle has not been assigned to the
> context ivgen_ctx at this point, so the resources are not freed.
> Fix this by setting drvdata->ivgen_handle to ivgen_ctx as early
> as possible so that the clean up error exit return path can free
> the resources.
>
> Detected by CoveritScan, CID#1463795 ("Resource leak")
>
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/staging/ccree/cc_ivgen.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/staging/ccree/cc_ivgen.c b/drivers/staging/ccree/cc_ivgen.c
> index 25a3131a93ce..c47f419b277b 100644
> --- a/drivers/staging/ccree/cc_ivgen.c
> +++ b/drivers/staging/ccree/cc_ivgen.c
> @@ -178,6 +178,8 @@ int cc_ivgen_init(struct cc_drvdata *drvdata)
>         if (!ivgen_ctx)
>                 return -ENOMEM;
>
> +       drvdata->ivgen_handle = ivgen_ctx;
> +
>         /* Allocate pool's header for initial enc. key/IV */
>         ivgen_ctx->pool_meta = dma_alloc_coherent(device, CC_IVPOOL_META_SIZE,
>                                                   &ivgen_ctx->pool_meta_dma,
> @@ -196,8 +198,6 @@ int cc_ivgen_init(struct cc_drvdata *drvdata)
>                 goto out;
>         }
>
> -       drvdata->ivgen_handle = ivgen_ctx;
> -
>         return cc_init_iv_sram(drvdata);
>
>  out:
> --
> 2.15.1
>

Good catch!

Acked-by: Gilad Ben-Yossef <gilad@...yossef.com>

Thanks,
Gilad

-- 
Gilad Ben-Yossef
Chief Coffee Drinker

"If you take a class in large-scale robotics, can you end up in a
situation where the homework eats your dog?"
 -- Jean-Baptiste Queru