linux-kernel - Re: [PATCH -next] firmware_loader: Fix possible resource leak in fw_log_firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241023204954.d4n5rba6e37cvmpn@4VRSMR2-DT.corp.robot.car>
Date: Wed, 23 Oct 2024 13:49:54 -0700
From: Russ Weight <russ.weight@...ux.dev>
To: Gaosheng Cui <cuigaosheng1@...wei.com>
Cc: mcgrof@...nel.org, dakr@...hat.com, gregkh@...uxfoundation.org,
	rafael@...nel.org, amadeuszx.slawinski@...ux.intel.com,
	cezary.rojewski@...el.com, wangweiyang2@...wei.com,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH -next] firmware_loader: Fix possible resource leak in
 fw_log_firmware_info()


On Wed, Oct 16, 2024 at 07:03:35PM +0800, Gaosheng Cui wrote:
> The alg instance should be released under the exception path, otherwise
> there may be resource leak here.
> 
> To mitigate this, free the alg instance with crypto_free_shash when kmalloc
> fails.
> 
> Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file")
> Signed-off-by: Gaosheng Cui <cuigaosheng1@...wei.com>

Reviewed-by: Russ Weight <russ.weight@...ux.dev>

> ---
>  drivers/base/firmware_loader/main.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
> index 324a9a3c087a..c6664a787969 100644
> --- a/drivers/base/firmware_loader/main.c
> +++ b/drivers/base/firmware_loader/main.c
> @@ -829,19 +829,18 @@ static void fw_log_firmware_info(const struct firmware *fw, const char *name, st
>  	shash->tfm = alg;
>  
>  	if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0)
> -		goto out_shash;
> +		goto out_free;
>  
>  	for (int i = 0; i < SHA256_DIGEST_SIZE; i++)
>  		sprintf(&outbuf[i * 2], "%02x", sha256buf[i]);
>  	outbuf[SHA256_BLOCK_SIZE] = 0;
>  	dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf);
>  
> -out_shash:
> -	crypto_free_shash(alg);
>  out_free:
>  	kfree(shash);
>  	kfree(outbuf);
>  	kfree(sha256buf);
> +	crypto_free_shash(alg);
>  }
>  #else
>  static void fw_log_firmware_info(const struct firmware *fw, const char *name,
> -- 
> 2.25.1
>