diff options
| author | Colin Ian King <colin.king@canonical.com> | 2021-03-02 16:34:46 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-14 09:50:10 +0200 |
| commit | 617ec35ed51f731a593ae7274228ef2cfc9cb781 (patch) | |
| tree | 8800fb06c7cf2e4bd3ed8f61e1c02071c7ef0c55 /drivers/crypto | |
| parent | 75d0f3fb02d99450667bb846b95c872c633bb128 (diff) | |
| download | linux-rt-617ec35ed51f731a593ae7274228ef2cfc9cb781.tar.gz | |
crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map
[ Upstream commit 98b5ef3e97b16eaeeedb936f8bda3594ff84a70e ]
In the case where the dma_iv mapping fails, the return error path leaks
the memory allocated to object d. Fix this by adding a new error return
label and jumping to this to ensure d is free'd before the return.
Addresses-Coverity: ("Resource leak")
Fixes: ac2614d721de ("crypto: sun8i-ss - Add support for the PRNG")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Acked-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/crypto')
| -rw-r--r-- | drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c index 08a1473b2145..3191527928e4 100644 --- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c +++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-prng.c @@ -103,7 +103,8 @@ int sun8i_ss_prng_generate(struct crypto_rng *tfm, const u8 *src, dma_iv = dma_map_single(ss->dev, ctx->seed, ctx->slen, DMA_TO_DEVICE); if (dma_mapping_error(ss->dev, dma_iv)) { dev_err(ss->dev, "Cannot DMA MAP IV\n"); - return -EFAULT; + err = -EFAULT; + goto err_free; } dma_dst = dma_map_single(ss->dev, d, todo, DMA_FROM_DEVICE); @@ -167,6 +168,7 @@ err_iv: memcpy(ctx->seed, d + dlen, ctx->slen); } memzero_explicit(d, todo); +err_free: kfree(d); return err; |