Commit 89f58f96 authored by Gaosheng Cui's avatar Gaosheng Cui Committed by Keith Busch
Browse files

nvmet-auth: fix nvmet_auth hash error handling 



If we fail to call nvme_auth_augmented_challenge, or fail to kmalloc
for shash, we should free the memory allocation for challenge, so add
err path out_free_challenge to fix the memory leak.

Fixes: 7a277c37 ("nvmet-auth: Diffie-Hellman key exchange support")
Signed-off-by: default avatarGaosheng Cui <cuigaosheng1@huawei.com>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent 18f03a06

drivers/nvme/target/auth.c

+8 −6
Original line number Diff line number Diff line
@@ -314,7 +314,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, 
						    req->sq->dhchap_c1,

						    challenge, shash_len);

		if (ret)

			goto out_free_response;

			goto out_free_challenge;

	}



	pr_debug("ctrl %d qid %d host response seq %u transaction %d\n",
@@ -325,7 +325,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, 
			GFP_KERNEL);

	if (!shash) {

		ret = -ENOMEM;

		goto out_free_response;

		goto out_free_challenge;

	}

	shash->tfm = shash_tfm;

	ret = crypto_shash_init(shash);
@@ -361,9 +361,10 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response, 
		goto out;

	ret = crypto_shash_final(shash, response);

out:

	kfree(shash);

out_free_challenge:

	if (challenge != req->sq->dhchap_c1)

		kfree(challenge);

	kfree(shash);

out_free_response:

	nvme_auth_free_key(transformed_key);

out_free_tfm:
@@ -427,14 +428,14 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, 
						    req->sq->dhchap_c2,

						    challenge, shash_len);

		if (ret)

			goto out_free_response;

			goto out_free_challenge;

	}



	shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(shash_tfm),

			GFP_KERNEL);

	if (!shash) {

		ret = -ENOMEM;

		goto out_free_response;

		goto out_free_challenge;

	}

	shash->tfm = shash_tfm;
@@ -471,9 +472,10 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response, 
		goto out;

	ret = crypto_shash_final(shash, response);

out:

	kfree(shash);

out_free_challenge:

	if (challenge != req->sq->dhchap_c2)

		kfree(challenge);

	kfree(shash);

out_free_response:

	nvme_auth_free_key(transformed_key);

out_free_tfm: