From patchwork Fri Oct 28 18:08:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin King X-Patchwork-Id: 9402549 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BB8E06022E for ; Fri, 28 Oct 2016 18:08:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B237F2A8B2 for ; Fri, 28 Oct 2016 18:08:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A52E72A8B9; Fri, 28 Oct 2016 18:08:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3E75A2A8B2 for ; Fri, 28 Oct 2016 18:08:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S936570AbcJ1SI3 (ORCPT ); Fri, 28 Oct 2016 14:08:29 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:55570 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934180AbcJ1SI2 (ORCPT ); Fri, 28 Oct 2016 14:08:28 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1c0BZp-0003mX-8I; Fri, 28 Oct 2016 18:08:25 +0000 From: Colin King To: Johannes Berg , "David S . Miller" , linux-wireless@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] mac80211: fix incorrect error return path on tmp allocation failure Date: Fri, 28 Oct 2016 19:08:24 +0100 Message-Id: <20161028180824.7110-1-colin.king@canonical.com> X-Mailer: git-send-email 2.9.3 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Colin Ian King The current exit path when tmp fails to be allocated is via the fail label which frees tfm2 which has not yet been allocated, which is problematic since tfm2 is not initialized and is a garbage pointer. Fix this by exiting directly to the return at the end of the function and hence avoiding the freeing of tfm2. Signed-off-by: Colin Ian King --- net/mac80211/fils_aead.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/fils_aead.c b/net/mac80211/fils_aead.c index b81b4f24..c114737 100644 --- a/net/mac80211/fils_aead.c +++ b/net/mac80211/fils_aead.c @@ -112,7 +112,7 @@ static int aes_siv_encrypt(const u8 *key, size_t key_len, tmp = kmemdup(plain, plain_len, GFP_KERNEL); if (!tmp) { res = -ENOMEM; - goto fail; + goto fail_ret; } /* IV for CTR before encrypted data */ @@ -150,6 +150,7 @@ static int aes_siv_encrypt(const u8 *key, size_t key_len, fail: kfree(tmp); crypto_free_skcipher(tfm2); +fail_ret: return res; }