Re: [PATCH] security: keys: trusted: Fix memory leaks on allocated blob
From: Sumit Garg <hidden>
Date: 2021-07-26 05:33:27
Also in:
kernel-janitors, keyrings, linux-integrity, lkml
Hi Colin, On Fri, 23 Jul 2021 at 22:51, Colin King [off-list ref] wrote:
From: Colin Ian King <redacted> There are several error return paths that don't kfree the allocated blob, leading to memory leaks. Ensure blob is initialized to null as some of the error return paths in function tpm2_key_decode do not change blob. Add an error return path to kfree blob and use this on the current leaky returns.
It looks like there are still leaky return paths left such as tpm_buf_init() failure etc. which needs to be fixed as well. With that addressed, feel free to add: Acked-by: Sumit Garg <redacted> -Sumit
quoted hunk ↗ jump to hunk
Addresses-Coverity: ("Resource leak") Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs") Signed-off-by: Colin Ian King <redacted> --- security/keys/trusted-keys/trusted_tpm2.c | 30 ++++++++++++++++------- 1 file changed, 21 insertions(+), 9 deletions(-)diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 0165da386289..930c67f98611 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c@@ -366,7 +366,7 @@ static int tpm2_load_cmd(struct tpm_chip *chip, unsigned int private_len; unsigned int public_len; unsigned int blob_len; - u8 *blob, *pub; + u8 *blob = NULL, *pub; int rc; u32 attrs;@@ -378,22 +378,30 @@ static int tpm2_load_cmd(struct tpm_chip *chip, } /* new format carries keyhandle but old format doesn't */ - if (!options->keyhandle) - return -EINVAL; + if (!options->keyhandle) { + rc = -EINVAL; + goto err; + } /* must be big enough for at least the two be16 size counts */ - if (payload->blob_len < 4) - return -EINVAL; + if (payload->blob_len < 4) { + rc = -EINVAL; + goto err; + } private_len = get_unaligned_be16(blob); /* must be big enough for following public_len */ - if (private_len + 2 + 2 > (payload->blob_len)) - return -E2BIG; + if (private_len + 2 + 2 > (payload->blob_len)) { + rc = -E2BIG; + goto err; + } public_len = get_unaligned_be16(blob + 2 + private_len); - if (private_len + 2 + public_len + 2 > payload->blob_len) - return -E2BIG; + if (private_len + 2 + public_len + 2 > payload->blob_len) { + rc = -E2BIG; + goto err; + } pub = blob + 2 + private_len + 2; /* key attributes are always at offset 4 */@@ -441,6 +449,10 @@ static int tpm2_load_cmd(struct tpm_chip *chip, rc = -EPERM; return rc; + +err: + kfree(blob); + return rc; } /** --2.31.1