[cryptodev:master 149/150] drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference preceded by free on line 1172 (fwd)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello,

There seems to be a double free on lines 1172 and 1213.

julia

---------- Forwarded message ----------
Date: Sun, 22 Mar 2020 17:21:30 +0800
From: kbuild test robot <lkp@xxxxxxxxx>
To: kbuild@xxxxxxxxxxxx
Cc: Julia Lawall <julia.lawall@xxxxxxx>
Subject: [cryptodev:master 149/150]
    drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference
     preceded by free on line 1172

CC: kbuild-all@xxxxxxxxxxxx
CC: linux-crypto@xxxxxxxxxxxxxxx
TO: SrujanaChalla <schalla@xxxxxxxxxxx>
CC: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
head:   f6913d040c8d2d8294d0a06c9d2a2aa4a02fb8c0
commit: 6482023b9d3350bf1b756ef36e1ea1a1c871879c [149/150] crypto: marvell - enable OcteonTX cpt options for build
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@xxxxxxxxx>
Reported-by: Julia Lawall <julia.lawall@xxxxxxx>

>> drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference preceded by free on line 1172

# https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/commit/?id=6482023b9d3350bf1b756ef36e1ea1a1c871879c
git remote add cryptodev https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
git remote update cryptodev
git checkout 6482023b9d3350bf1b756ef36e1ea1a1c871879c
vim +1213 drivers/crypto/marvell/octeontx/otx_cptvf_algs.c

10b4f09491bfeb SrujanaChalla 2020-03-13  1130
10b4f09491bfeb SrujanaChalla 2020-03-13  1131  static inline u32 create_aead_null_output_list(struct aead_request *req,
10b4f09491bfeb SrujanaChalla 2020-03-13  1132  					       u32 enc, u32 mac_len)
10b4f09491bfeb SrujanaChalla 2020-03-13  1133  {
10b4f09491bfeb SrujanaChalla 2020-03-13  1134  	struct otx_cpt_req_ctx *rctx = aead_request_ctx(req);
10b4f09491bfeb SrujanaChalla 2020-03-13  1135  	struct otx_cpt_req_info *req_info =  &rctx->cpt_req;
10b4f09491bfeb SrujanaChalla 2020-03-13  1136  	struct scatterlist *dst;
10b4f09491bfeb SrujanaChalla 2020-03-13  1137  	u8 *ptr = NULL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1138  	int argcnt = 0, status, offset;
10b4f09491bfeb SrujanaChalla 2020-03-13  1139  	u32 inputlen;
10b4f09491bfeb SrujanaChalla 2020-03-13  1140
10b4f09491bfeb SrujanaChalla 2020-03-13  1141  	if (enc)
10b4f09491bfeb SrujanaChalla 2020-03-13  1142  		inputlen =  req->cryptlen + req->assoclen;
10b4f09491bfeb SrujanaChalla 2020-03-13  1143  	else
10b4f09491bfeb SrujanaChalla 2020-03-13  1144  		inputlen =  req->cryptlen + req->assoclen - mac_len;
10b4f09491bfeb SrujanaChalla 2020-03-13  1145
10b4f09491bfeb SrujanaChalla 2020-03-13  1146  	/*
10b4f09491bfeb SrujanaChalla 2020-03-13  1147  	 * If source and destination are different
10b4f09491bfeb SrujanaChalla 2020-03-13  1148  	 * then copy payload to destination
10b4f09491bfeb SrujanaChalla 2020-03-13  1149  	 */
10b4f09491bfeb SrujanaChalla 2020-03-13  1150  	if (req->src != req->dst) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1151
10b4f09491bfeb SrujanaChalla 2020-03-13  1152  		ptr = kmalloc(inputlen, (req_info->areq->flags &
10b4f09491bfeb SrujanaChalla 2020-03-13  1153  					 CRYPTO_TFM_REQ_MAY_SLEEP) ?
10b4f09491bfeb SrujanaChalla 2020-03-13  1154  					 GFP_KERNEL : GFP_ATOMIC);
10b4f09491bfeb SrujanaChalla 2020-03-13  1155  		if (!ptr) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1156  			status = -ENOMEM;
10b4f09491bfeb SrujanaChalla 2020-03-13  1157  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1158  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1159
10b4f09491bfeb SrujanaChalla 2020-03-13  1160  		status = sg_copy_to_buffer(req->src, sg_nents(req->src), ptr,
10b4f09491bfeb SrujanaChalla 2020-03-13  1161  					   inputlen);
10b4f09491bfeb SrujanaChalla 2020-03-13  1162  		if (status != inputlen) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1163  			status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1164  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1165  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1166  		status = sg_copy_from_buffer(req->dst, sg_nents(req->dst), ptr,
10b4f09491bfeb SrujanaChalla 2020-03-13  1167  					     inputlen);
10b4f09491bfeb SrujanaChalla 2020-03-13  1168  		if (status != inputlen) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1169  			status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1170  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1171  		}
10b4f09491bfeb SrujanaChalla 2020-03-13 @1172  		kfree(ptr);
10b4f09491bfeb SrujanaChalla 2020-03-13  1173  	}
10b4f09491bfeb SrujanaChalla 2020-03-13  1174
10b4f09491bfeb SrujanaChalla 2020-03-13  1175  	if (enc) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1176  		/*
10b4f09491bfeb SrujanaChalla 2020-03-13  1177  		 * In an encryption scenario hmac needs
10b4f09491bfeb SrujanaChalla 2020-03-13  1178  		 * to be appended after payload
10b4f09491bfeb SrujanaChalla 2020-03-13  1179  		 */
10b4f09491bfeb SrujanaChalla 2020-03-13  1180  		dst = req->dst;
10b4f09491bfeb SrujanaChalla 2020-03-13  1181  		offset = inputlen;
10b4f09491bfeb SrujanaChalla 2020-03-13  1182  		while (offset >= dst->length) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1183  			offset -= dst->length;
10b4f09491bfeb SrujanaChalla 2020-03-13  1184  			dst = sg_next(dst);
10b4f09491bfeb SrujanaChalla 2020-03-13  1185  			if (!dst) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1186  				status = -ENOENT;
10b4f09491bfeb SrujanaChalla 2020-03-13  1187  				goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1188  			}
10b4f09491bfeb SrujanaChalla 2020-03-13  1189  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1190
10b4f09491bfeb SrujanaChalla 2020-03-13  1191  		update_output_data(req_info, dst, offset, mac_len, &argcnt);
10b4f09491bfeb SrujanaChalla 2020-03-13  1192  	} else {
10b4f09491bfeb SrujanaChalla 2020-03-13  1193  		/*
10b4f09491bfeb SrujanaChalla 2020-03-13  1194  		 * In a decryption scenario calculated hmac for received
10b4f09491bfeb SrujanaChalla 2020-03-13  1195  		 * payload needs to be compare with hmac received
10b4f09491bfeb SrujanaChalla 2020-03-13  1196  		 */
10b4f09491bfeb SrujanaChalla 2020-03-13  1197  		status = sg_copy_buffer(req->src, sg_nents(req->src),
10b4f09491bfeb SrujanaChalla 2020-03-13  1198  					rctx->fctx.hmac.s.hmac_recv, mac_len,
10b4f09491bfeb SrujanaChalla 2020-03-13  1199  					inputlen, true);
10b4f09491bfeb SrujanaChalla 2020-03-13  1200  		if (status != mac_len) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1201  			status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1202  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1203  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1204
10b4f09491bfeb SrujanaChalla 2020-03-13  1205  		req_info->out[argcnt].vptr = rctx->fctx.hmac.s.hmac_calc;
10b4f09491bfeb SrujanaChalla 2020-03-13  1206  		req_info->out[argcnt].size = mac_len;
10b4f09491bfeb SrujanaChalla 2020-03-13  1207  		argcnt++;
10b4f09491bfeb SrujanaChalla 2020-03-13  1208  	}
10b4f09491bfeb SrujanaChalla 2020-03-13  1209
10b4f09491bfeb SrujanaChalla 2020-03-13  1210  	req_info->outcnt = argcnt;
10b4f09491bfeb SrujanaChalla 2020-03-13  1211  	return 0;
10b4f09491bfeb SrujanaChalla 2020-03-13  1212  error:
10b4f09491bfeb SrujanaChalla 2020-03-13 @1213  	kfree(ptr);
10b4f09491bfeb SrujanaChalla 2020-03-13  1214  	return status;
10b4f09491bfeb SrujanaChalla 2020-03-13  1215  }
10b4f09491bfeb SrujanaChalla 2020-03-13  1216

:::::: The code at line 1213 was first introduced by commit
:::::: 10b4f09491bfeb0b298cb2f49df585510ee6189a crypto: marvell - add the Virtual Function driver for CPT

:::::: TO: SrujanaChalla <schalla@xxxxxxxxxxx>
:::::: CC: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx



[Index of Archives]     [Kernel]     [Gnu Classpath]     [Gnu Crypto]     [DM Crypt]     [Netfilter]     [Bugtraq]

  Powered by Linux