mirror of
https://github.com/torvalds/linux
synced 2024-09-06 01:40:28 +00:00
Revert "evm: Fix memleak in init_desc"
This reverts commitccf11dbaa0
. Commitccf11dbaa0
("evm: Fix memleak in init_desc") said there is memleak in init_desc. That may be incorrect, as we can see, tmp_tfm is saved in one of the two global variables hmac_tfm or evm_tfm[hash_algo], then if init_desc is called next time, there is no need to alloc tfm again, so in the error path of kmalloc desc or crypto_shash_init(desc), It is not a problem without freeing tmp_tfm. And also that commit did not reset the global variable to NULL after freeing tmp_tfm and this makes *tfm a dangling pointer which may cause a UAF issue. Reported-by: Guozihua (Scott) <guozihua@huawei.com> Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
parent
b13baccc38
commit
51dd64bb99
|
@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
|
|||
{
|
||||
long rc;
|
||||
const char *algo;
|
||||
struct crypto_shash **tfm, *tmp_tfm = NULL;
|
||||
struct crypto_shash **tfm, *tmp_tfm;
|
||||
struct shash_desc *desc;
|
||||
|
||||
if (type == EVM_XATTR_HMAC) {
|
||||
|
@ -120,16 +120,13 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
|
|||
alloc:
|
||||
desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
|
||||
GFP_KERNEL);
|
||||
if (!desc) {
|
||||
crypto_free_shash(tmp_tfm);
|
||||
if (!desc)
|
||||
return ERR_PTR(-ENOMEM);
|
||||
}
|
||||
|
||||
desc->tfm = *tfm;
|
||||
|
||||
rc = crypto_shash_init(desc);
|
||||
if (rc) {
|
||||
crypto_free_shash(tmp_tfm);
|
||||
kfree(desc);
|
||||
return ERR_PTR(rc);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue