Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac5f863f authored by Christian Engelmayer's avatar Christian Engelmayer Committed by Herbert Xu
Browse files

crypto: tcrypt - Fix potential leak in test_aead_speed() if aad_size is too big 



Fix a potential memory leak in the error handling of test_aead_speed(). In case
the size check on the associate data length parameter fails, the function goes
through the wrong exit label. Reported by Coverity - CID 1163870.

Signed-off-by: default avatarChristian Engelmayer <cengelma@gmx.at>
Acked-by: default avatarTim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 3d67be27

crypto/tcrypt.c

+6 −8
Original line number Original line Diff line number Diff line
@@ -282,6 +282,11 @@ static void test_aead_speed(const char *algo, int enc, unsigned int sec, 
	unsigned int *b_size;

	unsigned int *b_size;

	unsigned int iv_len;

	unsigned int iv_len;





	if (aad_size >= PAGE_SIZE) {

		pr_err("associate data length (%u) too big\n", aad_size);

		return;

	}



	if (enc == ENCRYPT)

	if (enc == ENCRYPT)

		e = "encryption";

		e = "encryption";

	else

	else
@@ -323,14 +328,7 @@ static void test_aead_speed(const char *algo, int enc, unsigned int sec, 
		b_size = aead_sizes;

		b_size = aead_sizes;

		do {

		do {

			assoc = axbuf[0];

			assoc = axbuf[0];



			if (aad_size < PAGE_SIZE)

			memset(assoc, 0xff, aad_size);

			memset(assoc, 0xff, aad_size);

			else {

				pr_err("associate data length (%u) too big\n",

					aad_size);

				goto out_nosg;

			}

			sg_init_one(&asg[0], assoc, aad_size);

			sg_init_one(&asg[0], assoc, aad_size);





			if ((*keysize + *b_size) > TVMEMSIZE * PAGE_SIZE) {

			if ((*keysize + *b_size) > TVMEMSIZE * PAGE_SIZE) {