>From 06c1a0fff81142dfa6d933479e17bb1b45ab9dc7 Mon Sep 17 00:00:00 2001 From: Markus Elfring <[email protected]> Date: Sun, 30 Nov 2014 17:07:34 +0100
The functions crypto_free_blkcipher((), crypto_free_hash() and kfree() could be called in some cases by the mppe_alloc() function during error handling even if the passed data structure element contained still a null pointer. This implementation detail could be improved by adjustments for jump labels. Signed-off-by: Markus Elfring <[email protected]> --- drivers/net/ppp/ppp_mppe.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c index 7e44212..962c1a0 100644 --- a/drivers/net/ppp/ppp_mppe.c +++ b/drivers/net/ppp/ppp_mppe.c @@ -197,11 +197,11 @@ static void *mppe_alloc(unsigned char *options, int optlen) if (optlen != CILEN_MPPE + sizeof(state->master_key) || options[0] != CI_MPPE || options[1] != CILEN_MPPE) - goto out; + return NULL; state = kzalloc(sizeof(*state), GFP_KERNEL); if (state == NULL) - goto out; + return NULL; state->arc4 = crypto_alloc_blkcipher("ecb(arc4)", 0, CRYPTO_ALG_ASYNC); @@ -213,16 +213,16 @@ static void *mppe_alloc(unsigned char *options, int optlen) state->sha1 = crypto_alloc_hash("sha1", 0, CRYPTO_ALG_ASYNC); if (IS_ERR(state->sha1)) { state->sha1 = NULL; - goto out_free; + goto out_free_blkcipher; } digestsize = crypto_hash_digestsize(state->sha1); if (digestsize < MPPE_MAX_KEY_LEN) - goto out_free; + goto out_free_hash; state->sha1_digest = kmalloc(digestsize, GFP_KERNEL); if (!state->sha1_digest) - goto out_free; + goto out_free_hash; /* Save keys. */ memcpy(state->master_key, &options[CILEN_MPPE], @@ -237,14 +237,12 @@ static void *mppe_alloc(unsigned char *options, int optlen) return (void *)state; - out_free: - kfree(state->sha1_digest); - if (state->sha1) - crypto_free_hash(state->sha1); - if (state->arc4) - crypto_free_blkcipher(state->arc4); - kfree(state); - out: +out_free_hash: + crypto_free_hash(state->sha1); +out_free_blkcipher: + crypto_free_blkcipher(state->arc4); +out_free: + kfree(state); return NULL; } -- 2.1.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
