Skip to content

Commit a836ca3

Browse files
Chaitanya Kulkarnikeithbusch
authored andcommitted
nvme-core: fix memory leak in dhchap_secret_store
Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return fix following kmemleack:- unreferenced object 0xffff8886376ea800 (size 64): comm "check", pid 22048, jiffies 4344316705 (age 92.199s) hex dump (first 32 bytes): 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL backtrace: [<0000000030ce5d4b>] __kmalloc+0x4b/0x130 [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core] [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0 [<00000000437e7ced>] vfs_write+0x2ba/0x3c0 [<00000000f9491baf>] ksys_write+0x5f/0xe0 [<000000001c46513d>] do_syscall_64+0x3b/0x90 [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff8886376eaf00 (size 64): comm "check", pid 22048, jiffies 4344316736 (age 92.168s) hex dump (first 32 bytes): 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL backtrace: [<0000000030ce5d4b>] __kmalloc+0x4b/0x130 [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core] [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0 [<00000000437e7ced>] vfs_write+0x2ba/0x3c0 [<00000000f9491baf>] ksys_write+0x5f/0xe0 [<000000001c46513d>] do_syscall_64+0x3b/0x90 [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: f50fff7 ("nvme: implement In-Band authentication") Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com> Tested-by: Yi Zhang <yi.zhang@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Keith Busch <kbusch@kernel.org>
1 parent 4f1731d commit a836ca3

1 file changed

Lines changed: 5 additions & 2 deletions

File tree

drivers/nvme/host/core.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3825,16 +3825,19 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
38253825
int ret;
38263826

38273827
ret = nvme_auth_generate_key(dhchap_secret, &key);
3828-
if (ret)
3828+
if (ret) {
3829+
kfree(dhchap_secret);
38293830
return ret;
3831+
}
38303832
kfree(opts->dhchap_secret);
38313833
opts->dhchap_secret = dhchap_secret;
38323834
host_key = ctrl->host_key;
38333835
mutex_lock(&ctrl->dhchap_auth_mutex);
38343836
ctrl->host_key = key;
38353837
mutex_unlock(&ctrl->dhchap_auth_mutex);
38363838
nvme_auth_free_key(host_key);
3837-
}
3839+
} else
3840+
kfree(dhchap_secret);
38383841
/* Start re-authentication */
38393842
dev_info(ctrl->device, "re-authenticating controller\n");
38403843
queue_work(nvme_wq, &ctrl->dhchap_auth_work);

0 commit comments

Comments
 (0)