linux-crypto.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Julia Lawall <julia.lawall@inria.fr>
To: SrujanaChalla <schalla@marvell.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
	linux-crypto@vger.kernel.org, kbuild-all@lists.01.org
Subject: [cryptodev:master 149/150] drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference preceded by free on line 1172 (fwd)
Date: Sun, 22 Mar 2020 11:12:44 +0100 (CET)	[thread overview]
Message-ID: <alpine.DEB.2.21.2003221111450.2325@hadrien> (raw)

Hello,

There seems to be a double free on lines 1172 and 1213.

julia

---------- Forwarded message ----------
Date: Sun, 22 Mar 2020 17:21:30 +0800
From: kbuild test robot <lkp@intel.com>
To: kbuild@lists.01.org
Cc: Julia Lawall <julia.lawall@lip6.fr>
Subject: [cryptodev:master 149/150]
    drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference
     preceded by free on line 1172

CC: kbuild-all@lists.01.org
CC: linux-crypto@vger.kernel.org
TO: SrujanaChalla <schalla@marvell.com>
CC: Herbert Xu <herbert@gondor.apana.org.au>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git master
head:   f6913d040c8d2d8294d0a06c9d2a2aa4a02fb8c0
commit: 6482023b9d3350bf1b756ef36e1ea1a1c871879c [149/150] crypto: marvell - enable OcteonTX cpt options for build
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>

>> drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference preceded by free on line 1172

# https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git/commit/?id=6482023b9d3350bf1b756ef36e1ea1a1c871879c
git remote add cryptodev https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
git remote update cryptodev
git checkout 6482023b9d3350bf1b756ef36e1ea1a1c871879c
vim +1213 drivers/crypto/marvell/octeontx/otx_cptvf_algs.c

10b4f09491bfeb SrujanaChalla 2020-03-13  1130
10b4f09491bfeb SrujanaChalla 2020-03-13  1131  static inline u32 create_aead_null_output_list(struct aead_request *req,
10b4f09491bfeb SrujanaChalla 2020-03-13  1132  					       u32 enc, u32 mac_len)
10b4f09491bfeb SrujanaChalla 2020-03-13  1133  {
10b4f09491bfeb SrujanaChalla 2020-03-13  1134  	struct otx_cpt_req_ctx *rctx = aead_request_ctx(req);
10b4f09491bfeb SrujanaChalla 2020-03-13  1135  	struct otx_cpt_req_info *req_info =  &rctx->cpt_req;
10b4f09491bfeb SrujanaChalla 2020-03-13  1136  	struct scatterlist *dst;
10b4f09491bfeb SrujanaChalla 2020-03-13  1137  	u8 *ptr = NULL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1138  	int argcnt = 0, status, offset;
10b4f09491bfeb SrujanaChalla 2020-03-13  1139  	u32 inputlen;
10b4f09491bfeb SrujanaChalla 2020-03-13  1140
10b4f09491bfeb SrujanaChalla 2020-03-13  1141  	if (enc)
10b4f09491bfeb SrujanaChalla 2020-03-13  1142  		inputlen =  req->cryptlen + req->assoclen;
10b4f09491bfeb SrujanaChalla 2020-03-13  1143  	else
10b4f09491bfeb SrujanaChalla 2020-03-13  1144  		inputlen =  req->cryptlen + req->assoclen - mac_len;
10b4f09491bfeb SrujanaChalla 2020-03-13  1145
10b4f09491bfeb SrujanaChalla 2020-03-13  1146  	/*
10b4f09491bfeb SrujanaChalla 2020-03-13  1147  	 * If source and destination are different
10b4f09491bfeb SrujanaChalla 2020-03-13  1148  	 * then copy payload to destination
10b4f09491bfeb SrujanaChalla 2020-03-13  1149  	 */
10b4f09491bfeb SrujanaChalla 2020-03-13  1150  	if (req->src != req->dst) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1151
10b4f09491bfeb SrujanaChalla 2020-03-13  1152  		ptr = kmalloc(inputlen, (req_info->areq->flags &
10b4f09491bfeb SrujanaChalla 2020-03-13  1153  					 CRYPTO_TFM_REQ_MAY_SLEEP) ?
10b4f09491bfeb SrujanaChalla 2020-03-13  1154  					 GFP_KERNEL : GFP_ATOMIC);
10b4f09491bfeb SrujanaChalla 2020-03-13  1155  		if (!ptr) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1156  			status = -ENOMEM;
10b4f09491bfeb SrujanaChalla 2020-03-13  1157  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1158  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1159
10b4f09491bfeb SrujanaChalla 2020-03-13  1160  		status = sg_copy_to_buffer(req->src, sg_nents(req->src), ptr,
10b4f09491bfeb SrujanaChalla 2020-03-13  1161  					   inputlen);
10b4f09491bfeb SrujanaChalla 2020-03-13  1162  		if (status != inputlen) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1163  			status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1164  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1165  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1166  		status = sg_copy_from_buffer(req->dst, sg_nents(req->dst), ptr,
10b4f09491bfeb SrujanaChalla 2020-03-13  1167  					     inputlen);
10b4f09491bfeb SrujanaChalla 2020-03-13  1168  		if (status != inputlen) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1169  			status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1170  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1171  		}
10b4f09491bfeb SrujanaChalla 2020-03-13 @1172  		kfree(ptr);
10b4f09491bfeb SrujanaChalla 2020-03-13  1173  	}
10b4f09491bfeb SrujanaChalla 2020-03-13  1174
10b4f09491bfeb SrujanaChalla 2020-03-13  1175  	if (enc) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1176  		/*
10b4f09491bfeb SrujanaChalla 2020-03-13  1177  		 * In an encryption scenario hmac needs
10b4f09491bfeb SrujanaChalla 2020-03-13  1178  		 * to be appended after payload
10b4f09491bfeb SrujanaChalla 2020-03-13  1179  		 */
10b4f09491bfeb SrujanaChalla 2020-03-13  1180  		dst = req->dst;
10b4f09491bfeb SrujanaChalla 2020-03-13  1181  		offset = inputlen;
10b4f09491bfeb SrujanaChalla 2020-03-13  1182  		while (offset >= dst->length) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1183  			offset -= dst->length;
10b4f09491bfeb SrujanaChalla 2020-03-13  1184  			dst = sg_next(dst);
10b4f09491bfeb SrujanaChalla 2020-03-13  1185  			if (!dst) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1186  				status = -ENOENT;
10b4f09491bfeb SrujanaChalla 2020-03-13  1187  				goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1188  			}
10b4f09491bfeb SrujanaChalla 2020-03-13  1189  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1190
10b4f09491bfeb SrujanaChalla 2020-03-13  1191  		update_output_data(req_info, dst, offset, mac_len, &argcnt);
10b4f09491bfeb SrujanaChalla 2020-03-13  1192  	} else {
10b4f09491bfeb SrujanaChalla 2020-03-13  1193  		/*
10b4f09491bfeb SrujanaChalla 2020-03-13  1194  		 * In a decryption scenario calculated hmac for received
10b4f09491bfeb SrujanaChalla 2020-03-13  1195  		 * payload needs to be compare with hmac received
10b4f09491bfeb SrujanaChalla 2020-03-13  1196  		 */
10b4f09491bfeb SrujanaChalla 2020-03-13  1197  		status = sg_copy_buffer(req->src, sg_nents(req->src),
10b4f09491bfeb SrujanaChalla 2020-03-13  1198  					rctx->fctx.hmac.s.hmac_recv, mac_len,
10b4f09491bfeb SrujanaChalla 2020-03-13  1199  					inputlen, true);
10b4f09491bfeb SrujanaChalla 2020-03-13  1200  		if (status != mac_len) {
10b4f09491bfeb SrujanaChalla 2020-03-13  1201  			status = -EINVAL;
10b4f09491bfeb SrujanaChalla 2020-03-13  1202  			goto error;
10b4f09491bfeb SrujanaChalla 2020-03-13  1203  		}
10b4f09491bfeb SrujanaChalla 2020-03-13  1204
10b4f09491bfeb SrujanaChalla 2020-03-13  1205  		req_info->out[argcnt].vptr = rctx->fctx.hmac.s.hmac_calc;
10b4f09491bfeb SrujanaChalla 2020-03-13  1206  		req_info->out[argcnt].size = mac_len;
10b4f09491bfeb SrujanaChalla 2020-03-13  1207  		argcnt++;
10b4f09491bfeb SrujanaChalla 2020-03-13  1208  	}
10b4f09491bfeb SrujanaChalla 2020-03-13  1209
10b4f09491bfeb SrujanaChalla 2020-03-13  1210  	req_info->outcnt = argcnt;
10b4f09491bfeb SrujanaChalla 2020-03-13  1211  	return 0;
10b4f09491bfeb SrujanaChalla 2020-03-13  1212  error:
10b4f09491bfeb SrujanaChalla 2020-03-13 @1213  	kfree(ptr);
10b4f09491bfeb SrujanaChalla 2020-03-13  1214  	return status;
10b4f09491bfeb SrujanaChalla 2020-03-13  1215  }
10b4f09491bfeb SrujanaChalla 2020-03-13  1216

:::::: The code at line 1213 was first introduced by commit
:::::: 10b4f09491bfeb0b298cb2f49df585510ee6189a crypto: marvell - add the Virtual Function driver for CPT

:::::: TO: SrujanaChalla <schalla@marvell.com>
:::::: CC: Herbert Xu <herbert@gondor.apana.org.au>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

                 reply	other threads:[~2020-03-22 10:12 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.21.2003221111450.2325@hadrien \
    --to=julia.lawall@inria.fr \
    --cc=herbert@gondor.apana.org.au \
    --cc=kbuild-all@lists.01.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=schalla@marvell.com \
    --subject='Re: [cryptodev:master 149/150] drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:1213:7-10: ERROR: reference preceded by free on line 1172 (fwd)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).