[PATCH 5.10 172/717] crypto: sun8i-ce - fix two error paths memory leak

From: Greg Kroah-Hartman
Date: Mon Dec 28 2020 - 09:07:46 EST


From: Corentin Labbe <clabbe@xxxxxxxxxxxx>

[ Upstream commit 732b764099f651a088fd931d7b8121b6aa84e62e ]

This patch fixes the following smatch warnings:
drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c:412
sun8i_ce_hash_run() warn: possible memory leak of 'result'
Note: "buf" is leaked as well.

Furthermore, in case of ENOMEM, crypto_finalize_hash_request() was not
called which was an error.

Fixes: 56f6d5aee88d ("crypto: sun8i-ce - support hash algorithms")
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Corentin Labbe <clabbe@xxxxxxxxxxxx>
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
.../crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 20 +++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
index a94bf28f858a7..4c5a2c11d7141 100644
--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
@@ -262,13 +262,13 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
u32 common;
u64 byte_count;
__le32 *bf;
- void *buf;
+ void *buf = NULL;
int j, i, todo;
int nbw = 0;
u64 fill, min_fill;
__be64 *bebits;
__le64 *lebits;
- void *result;
+ void *result = NULL;
u64 bs;
int digestsize;
dma_addr_t addr_res, addr_pad;
@@ -285,13 +285,17 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)

/* the padding could be up to two block. */
buf = kzalloc(bs * 2, GFP_KERNEL | GFP_DMA);
- if (!buf)
- return -ENOMEM;
+ if (!buf) {
+ err = -ENOMEM;
+ goto theend;
+ }
bf = (__le32 *)buf;

result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
- if (!result)
- return -ENOMEM;
+ if (!result) {
+ err = -ENOMEM;
+ goto theend;
+ }

flow = rctx->flow;
chan = &ce->chanlist[flow];
@@ -403,11 +407,11 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
dma_unmap_sg(ce->dev, areq->src, nr_sgs, DMA_TO_DEVICE);
dma_unmap_single(ce->dev, addr_res, digestsize, DMA_FROM_DEVICE);

- kfree(buf);

memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
- kfree(result);
theend:
+ kfree(buf);
+ kfree(result);
crypto_finalize_hash_request(engine, breq, err);
return 0;
}
--
2.27.0