| Message ID | 20231127034710.23413-1-dinghao.liu@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Herbert Xu |
| Headers | show |
| Series | [v2] crypto: ccp - fix memleak in ccp_init_dm_workarea | expand |
On 11/26/23 21:47, Dinghao Liu wrote: > When dma_map_single() fails, wa->address is supposed to be freed > by the callers of ccp_init_dm_workarea() through ccp_dm_free(). > However, many of the call spots don't expect to have to call > ccp_dm_free() on failure of ccp_init_dm_workarea(), which may > lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() > when dma_map_single() fails. > > Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support") > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> > --- > > Changelog: > > v2: -Improve the commit message. > -Set wa->address to NULL after kfree() to prevent double-free. > --- > drivers/crypto/ccp/ccp-ops.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c > index aa4e1a500691..cb8e99936abb 100644 > --- a/drivers/crypto/ccp/ccp-ops.c > +++ b/drivers/crypto/ccp/ccp-ops.c > @@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, > > wa->dma.address = dma_map_single(wa->dev, wa->address, len, > dir); > - if (dma_mapping_error(wa->dev, wa->dma.address)) > + if (dma_mapping_error(wa->dev, wa->dma.address)) { > + kfree(wa->address); > + wa->address = NULL; > return -ENOMEM; > + } > > wa->dma.length = len; > }
On Mon, Nov 27, 2023 at 11:47:10AM +0800, Dinghao Liu wrote: > When dma_map_single() fails, wa->address is supposed to be freed > by the callers of ccp_init_dm_workarea() through ccp_dm_free(). > However, many of the call spots don't expect to have to call > ccp_dm_free() on failure of ccp_init_dm_workarea(), which may > lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() > when dma_map_single() fails. > > Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support") > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> > --- > > Changelog: > > v2: -Improve the commit message. > -Set wa->address to NULL after kfree() to prevent double-free. > --- > drivers/crypto/ccp/ccp-ops.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) Patch applied. Thanks.
diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c index aa4e1a500691..cb8e99936abb 100644 --- a/drivers/crypto/ccp/ccp-ops.c +++ b/drivers/crypto/ccp/ccp-ops.c @@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, wa->dma.address = dma_map_single(wa->dev, wa->address, len, dir); - if (dma_mapping_error(wa->dev, wa->dma.address)) + if (dma_mapping_error(wa->dev, wa->dma.address)) { + kfree(wa->address); + wa->address = NULL; return -ENOMEM; + } wa->dma.length = len; }
When dma_map_single() fails, wa->address is supposed to be freed by the callers of ccp_init_dm_workarea() through ccp_dm_free(). However, many of the call spots don't expect to have to call ccp_dm_free() on failure of ccp_init_dm_workarea(), which may lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() when dma_map_single() fails. Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> --- Changelog: v2: -Improve the commit message. -Set wa->address to NULL after kfree() to prevent double-free. --- drivers/crypto/ccp/ccp-ops.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)