linux-kernel - Re: [PATCH] crypto: stm32 - Handle failure of kmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Yr1HL5dr/zUyx+5q@gondor.apana.org.au>
Date:   Thu, 30 Jun 2022 14:48:15 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Li Qiong <liqiong@...china.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        Alexandre Torgue <alexandre.torgue@...s.st.com>,
        "Rafael J . Wysocki" <rafael.j.wysocki@...el.com>,
        linux-crypto@...r.kernel.org,
        linux-stm32@...md-mailman.stormreply.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        yuzhe@...china.com, renyu@...china.com
Subject: Re: [PATCH] crypto: stm32 - Handle failure of kmalloc_array()

On Wed, Jun 22, 2022 at 10:02:08AM +0800, Li Qiong wrote:
> As the possible failure of the kmalloc_array(), therefore it
> should be better to check it and return '-ENOMEM' on error.
> 
> Signed-off-by: Li Qiong <liqiong@...china.com>
> ---
>  drivers/crypto/stm32/stm32-hash.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
> index d33006d43f76..fc03e32e364f 100644
> --- a/drivers/crypto/stm32/stm32-hash.c
> +++ b/drivers/crypto/stm32/stm32-hash.c
> @@ -970,6 +970,8 @@ static int stm32_hash_export(struct ahash_request *req, void *out)
>  	rctx->hw_context = kmalloc_array(3 + HASH_CSR_REGISTER_NUMBER,
>  					 sizeof(u32),
>  					 GFP_KERNEL);
> +	if (!rctx->hw_context)
> +		return -ENOMEM;

Actually the problem is bigger than that.  The driver should not be
allocating memory in the export function at all.  This memory will
be leaked as exported requests won't be finalized.

We need to fix this driver to do export properly, or if that's not
possible, we should delete this driver.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt