Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 40c10017 authored by Mimi Zohar's avatar Mimi Zohar Committed by James Morris
Browse files

trusted-keys: free memory bugfix 



Add missing kfree(td) in tpm_seal() before the return, freeing
td on error paths as well.

Reported-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
Acked-by: default avatarDavid Safford <safford@watson.ibm.com>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarSerge Hallyn <serge@hallyn.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 581548db

security/keys/trusted_defined.c

+7 −5
Original line number Diff line number Diff line
@@ -511,7 +511,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, 
	/* get session for sealing key */

	ret = osap(tb, &sess, keyauth, keytype, keyhandle);

	if (ret < 0)

		return ret;

		goto out;

	dump_sess(&sess);



	/* calculate encrypted authorization value */
@@ -519,11 +519,11 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, 
	memcpy(td->xorwork + SHA1_DIGEST_SIZE, sess.enonce, SHA1_DIGEST_SIZE);

	ret = TSS_sha1(td->xorwork, SHA1_DIGEST_SIZE * 2, td->xorhash);

	if (ret < 0)

		return ret;

		goto out;



	ret = tpm_get_random(tb, td->nonceodd, TPM_NONCE_SIZE);

	if (ret < 0)

		return ret;

		goto out;

	ordinal = htonl(TPM_ORD_SEAL);

	datsize = htonl(datalen);

	pcrsize = htonl(pcrinfosize);
@@ -552,7 +552,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, 
				   &datsize, datalen, data, 0, 0);

	}

	if (ret < 0)

		return ret;

		goto out;



	/* build and send the TPM request packet */

	INIT_BUF(tb);
@@ -572,7 +572,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, 


	ret = trusted_tpm_send(TPM_ANY_NUM, tb->data, MAX_BUF_SIZE);

	if (ret < 0)

		return ret;

		goto out;



	/* calculate the size of the returned Blob */

	sealinfosize = LOAD32(tb->data, TPM_DATA_OFFSET + sizeof(uint32_t));
@@ -591,6 +591,8 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, 
		memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);

		*bloblen = storedsize;

	}

out:

	kfree(td);

	return ret;

}