Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e7980748 authored by Qiushi Wu's avatar Qiushi Wu Committed by Greg Kroah-Hartman
Browse files

rxrpc: Fix a memory leak in rxkad_verify_response() 



commit f45d01f4f30b53c3a0a1c6c1c154acb7ff74ab9f upstream.

A ticket was not released after a call of the function
"rxkad_decrypt_ticket" failed. Thus replace the jump target
"temporary_error_free_resp" by "temporary_error_free_ticket".

Fixes: 8c2f826d ("rxrpc: Don't put crypto buffers on the stack")
Signed-off-by: default avatarQiushi Wu <wu000273@umn.edu>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
cc: Markus Elfring <Markus.Elfring@web.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 0ce2f76e

net/rxrpc/rxkad.c

+1 −2
Original line number Diff line number Diff line
@@ -1118,7 +1118,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, 
	ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key,

				   &expiry, _abort_code);

	if (ret < 0)

		goto temporary_error_free_resp;

		goto temporary_error_free_ticket;



	/* use the session key from inside the ticket to decrypt the

	 * response */
@@ -1200,7 +1200,6 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, 


temporary_error_free_ticket:

	kfree(ticket);

temporary_error_free_resp:

	kfree(response);

temporary_error:

	/* Ignore the response packet if we got a temporary error such as