diff options
| author | Tom Rix <trix@redhat.com> | 2022-02-15 05:05:41 +0300 |
|---|---|---|
| committer | Joel Stanley <joel@jms.id.au> | 2022-03-18 03:38:41 +0300 |
| commit | de095564ecb4b484458a67dc2756fb1e5ffd6e77 (patch) | |
| tree | 5ab6e6da6329f42fc84fa6865215be6c2bc0595c /net/mctp | |
| parent | 75ce2111151a757729dd33d498b1d1cf58af8636 (diff) | |
| download | linux-de095564ecb4b484458a67dc2756fb1e5ffd6e77.tar.xz | |
mctp: fix use after free
Clang static analysis reports this problem
route.c:425:4: warning: Use of memory after it is freed
trace_mctp_key_acquire(key);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
When mctp_key_add() fails, key is freed but then is later
used in trace_mctp_key_acquire(). Add an else statement
to use the key only when mctp_key_add() is successful.
OpenBMC-Staging-Count: 1
Fixes: 4f9e1ba6de45 ("mctp: Add tracepoints for tag/key handling")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 7e5b6a5c8c44310784c88c1c198dde79f6402f7b)
Signed-off-by: Joel Stanley <joel@jms.id.au>
Diffstat (limited to 'net/mctp')
| -rw-r--r-- | net/mctp/route.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/net/mctp/route.c b/net/mctp/route.c index 17e3482aa770..0c4c56e1bd6e 100644 --- a/net/mctp/route.c +++ b/net/mctp/route.c @@ -419,13 +419,14 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) * this function. */ rc = mctp_key_add(key, msk); - if (rc) + if (rc) { kfree(key); + } else { + trace_mctp_key_acquire(key); - trace_mctp_key_acquire(key); - - /* we don't need to release key->lock on exit */ - mctp_key_unref(key); + /* we don't need to release key->lock on exit */ + mctp_key_unref(key); + } key = NULL; } else { |