| From 5d59ad6eea82ef8df92b4109615a0dde9d8093e9 Mon Sep 17 00:00:00 2001 |
| From: Christian Lamparter <chunkeey@googlemail.com> |
| Date: Fri, 25 Aug 2017 15:47:24 +0200 |
| Subject: crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak |
| |
| From: Christian Lamparter <chunkeey@googlemail.com> |
| |
| commit 5d59ad6eea82ef8df92b4109615a0dde9d8093e9 upstream. |
| |
| If one of the later memory allocations in rypto4xx_build_pdr() |
| fails: dev->pdr (and/or) dev->pdr_uinfo wouldn't be freed. |
| |
| crypto4xx_build_sdr() has the same issue with dev->sdr. |
| |
| Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Amit Pundir <amit.pundir@linaro.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/crypto/amcc/crypto4xx_core.c | 17 +++++++++-------- |
| 1 file changed, 9 insertions(+), 8 deletions(-) |
| |
| --- a/drivers/crypto/amcc/crypto4xx_core.c |
| +++ b/drivers/crypto/amcc/crypto4xx_core.c |
| @@ -207,7 +207,7 @@ static u32 crypto4xx_build_pdr(struct cr |
| dev->pdr_pa); |
| return -ENOMEM; |
| } |
| - memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD); |
| + memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD); |
| dev->shadow_sa_pool = dma_alloc_coherent(dev->core_dev->device, |
| 256 * PPC4XX_NUM_PD, |
| &dev->shadow_sa_pool_pa, |
| @@ -240,13 +240,15 @@ static u32 crypto4xx_build_pdr(struct cr |
| |
| static void crypto4xx_destroy_pdr(struct crypto4xx_device *dev) |
| { |
| - if (dev->pdr != NULL) |
| + if (dev->pdr) |
| dma_free_coherent(dev->core_dev->device, |
| sizeof(struct ce_pd) * PPC4XX_NUM_PD, |
| dev->pdr, dev->pdr_pa); |
| + |
| if (dev->shadow_sa_pool) |
| dma_free_coherent(dev->core_dev->device, 256 * PPC4XX_NUM_PD, |
| dev->shadow_sa_pool, dev->shadow_sa_pool_pa); |
| + |
| if (dev->shadow_sr_pool) |
| dma_free_coherent(dev->core_dev->device, |
| sizeof(struct sa_state_record) * PPC4XX_NUM_PD, |
| @@ -416,12 +418,12 @@ static u32 crypto4xx_build_sdr(struct cr |
| |
| static void crypto4xx_destroy_sdr(struct crypto4xx_device *dev) |
| { |
| - if (dev->sdr != NULL) |
| + if (dev->sdr) |
| dma_free_coherent(dev->core_dev->device, |
| sizeof(struct ce_sd) * PPC4XX_NUM_SD, |
| dev->sdr, dev->sdr_pa); |
| |
| - if (dev->scatter_buffer_va != NULL) |
| + if (dev->scatter_buffer_va) |
| dma_free_coherent(dev->core_dev->device, |
| dev->scatter_buffer_size * PPC4XX_NUM_SD, |
| dev->scatter_buffer_va, |
| @@ -1186,7 +1188,7 @@ static int crypto4xx_probe(struct platfo |
| |
| rc = crypto4xx_build_gdr(core_dev->dev); |
| if (rc) |
| - goto err_build_gdr; |
| + goto err_build_pdr; |
| |
| rc = crypto4xx_build_sdr(core_dev->dev); |
| if (rc) |
| @@ -1228,12 +1230,11 @@ err_iomap: |
| err_request_irq: |
| irq_dispose_mapping(core_dev->irq); |
| tasklet_kill(&core_dev->tasklet); |
| - crypto4xx_destroy_sdr(core_dev->dev); |
| err_build_sdr: |
| + crypto4xx_destroy_sdr(core_dev->dev); |
| crypto4xx_destroy_gdr(core_dev->dev); |
| -err_build_gdr: |
| - crypto4xx_destroy_pdr(core_dev->dev); |
| err_build_pdr: |
| + crypto4xx_destroy_pdr(core_dev->dev); |
| kfree(core_dev->dev); |
| err_alloc_dev: |
| kfree(core_dev); |