Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1511321 > unrolled thread

[PATCH] mac80211: fix incorrect error return path on tmp allocation failure

Back to article view | Back to linux.kernel

Contents

  [PATCH] mac80211: fix incorrect error return path on tmp allocation failure Colin King <colin.king@canonical.com> - 2016-10-28 20:10 +0200
    Re: [PATCH] mac80211: fix incorrect error return path on tmp  allocation failure Johannes Berg <johannes@sipsolutions.net> - 2016-10-28 20:30 +0200

#1511321 — [PATCH] mac80211: fix incorrect error return path on tmp allocation failure

From: Colin Ian King <colin.king@canonical.com>

The current exit path when tmp fails to be allocated is via the
fail label which frees tfm2 which has not yet been allocated,
which is problematic since tfm2 is not initialized and is a garbage
pointer. Fix this by exiting directly to the return at the end
of the function and hence avoiding the freeing of tfm2.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 net/mac80211/fils_aead.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/fils_aead.c b/net/mac80211/fils_aead.c
index b81b4f24..c114737 100644
--- a/net/mac80211/fils_aead.c
+++ b/net/mac80211/fils_aead.c
@@ -112,7 +112,7 @@ static int aes_siv_encrypt(const u8 *key, size_t key_len,
 	tmp = kmemdup(plain, plain_len, GFP_KERNEL);
 	if (!tmp) {
 		res = -ENOMEM;
-		goto fail;
+		goto fail_ret;
 	}
 
 	/* IV for CTR before encrypted data */
@@ -150,6 +150,7 @@ static int aes_siv_encrypt(const u8 *key, size_t key_len,
 fail:
 	kfree(tmp);
 	crypto_free_skcipher(tfm2);
+fail_ret:
 	return res;
 }
 
-- 
2.9.3

[toc] | [next] | [standalone]

#1511334 — Re: [PATCH] mac80211: fix incorrect error return path on tmp allocation failure

On Fri, 2016-10-28 at 19:08 +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> The current exit path when tmp fails to be allocated is via the
> fail label which frees tfm2 which has not yet been allocated,
> which is problematic since tfm2 is not initialized and is a garbage
> pointer. Fix this by exiting directly to the return at the end
> of the function and hence avoiding the freeing of tfm2.

Yeah, thanks. Arnd beat you to the fix by about 8 hours, so I've
already applied his patch and sent an updated pull request :)

johannes

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web