linux-kernel - [PATCH] tipc: stop tipc crypto on failure in tipc_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 Jul 2023 21:36:44 +0300
From:   Fedor Pchelkin <pchelkin@...ras.ru>
To:     Jon Maloy <jmaloy@...hat.com>
Cc:     Fedor Pchelkin <pchelkin@...ras.ru>,
        Ying Xue <ying.xue@...driver.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Xin Long <lucien.xin@...il.com>, netdev@...r.kernel.org,
        tipc-discussion@...ts.sourceforge.net,
        linux-kernel@...r.kernel.org,
        Alexey Khoroshilov <khoroshilov@...ras.ru>,
        lvc-project@...uxtesting.org
Subject: [PATCH] tipc: stop tipc crypto on failure in tipc_node_create

If tipc_link_bc_create() fails inside tipc_node_create() for a newly
allocated tipc node then we should stop its tipc crypto and free the
resources allocated with a call to tipc_crypto_start().

Call tipc_crypto_stop() in that case. Also extract the similar error exit
paths into a goto statement.

Found by Linux Verification Center (linuxtesting.org).

Fixes: cb8092d70a6f ("tipc: move bc link creation back to tipc_node_create")
Signed-off-by: Fedor Pchelkin <pchelkin@...ras.ru>
---
 net/tipc/node.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 5e000fde8067..0d64005a803b 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -546,9 +546,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
 #ifdef CONFIG_TIPC_CRYPTO
 	if (unlikely(tipc_crypto_start(&n->crypto_rx, net, n))) {
 		pr_warn("Failed to start crypto RX(%s)!\n", n->peer_id_string);
-		kfree(n);
-		n = NULL;
-		goto exit;
+		goto free_node;
 	}
 #endif
 	n->addr = addr;
@@ -583,9 +581,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
 				 n->capabilities, &n->bc_entry.inputq1,
 				 &n->bc_entry.namedq, snd_l, &n->bc_entry.link)) {
 		pr_warn("Broadcast rcv link creation failed, no memory\n");
-		kfree(n);
-		n = NULL;
-		goto exit;
+		goto stop_crypto;
 	}
 	tipc_node_get(n);
 	timer_setup(&n->timer, tipc_node_timeout, 0);
@@ -610,6 +606,15 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
 exit:
 	spin_unlock_bh(&tn->node_list_lock);
 	return n;
+stop_crypto:
+
+#ifdef CONFIG_TIPC_CRYPTO
+	tipc_crypto_stop(&n->crypto_rx);
+free_node:
+#endif
+	kfree(n);
+	spin_unlock_bh(&tn->node_list_lock);
+	return NULL;
 }
 
 static void tipc_node_calculate_timer(struct tipc_node *n, struct tipc_link *l)
-- 
2.41.0