[PATCH 5.11 258/601] crypto: sun8i-ss - Fix memory leak of pad

From: Greg Kroah-Hartman
Date: Wed May 12 2021 - 13:29:26 EST


From: Colin Ian King <colin.king@xxxxxxxxxxxxx>

[ Upstream commit 50274b01ac1689b1a3f6bc4b5b3dbf361a55dd3a ]

It appears there are several failure return paths that don't seem
to be free'ing pad. Fix these.

Addresses-Coverity: ("Resource leak")
Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms")
Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Acked-by: Corentin Labbe <clabbe.montjoie@xxxxxxxxx>
Tested-by: Corentin Labbe <clabbe.montjoie@xxxxxxxxx>
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
index 0b9aa24a5edd..64446b86c927 100644
--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
+++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c
@@ -348,8 +348,10 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
bf = (__le32 *)pad;

result = kzalloc(digestsize, GFP_KERNEL | GFP_DMA);
- if (!result)
+ if (!result) {
+ kfree(pad);
return -ENOMEM;
+ }

for (i = 0; i < MAX_SG; i++) {
rctx->t_dst[i].addr = 0;
@@ -435,10 +437,9 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq)
dma_unmap_sg(ss->dev, areq->src, nr_sgs, DMA_TO_DEVICE);
dma_unmap_single(ss->dev, addr_res, digestsize, DMA_FROM_DEVICE);

- kfree(pad);
-
memcpy(areq->result, result, algt->alg.hash.halg.digestsize);
theend:
+ kfree(pad);
kfree(result);
crypto_finalize_hash_request(engine, breq, err);
return 0;
--
2.30.2