nvmet-auth: fix nvmet_auth hash error handling

If we fail to call nvme_auth_augmented_challenge, or fail to kmalloc
for shash, we should free the memory allocation for challenge, so add
err path out_free_challenge to fix the memory leak.

Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 7d2633940f9b86cf1a0d17f2e62647dc7eda2b9d..8bc3f431c77f607cad2a8e76868ab5519ec6e1c4 100644 (file)
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -314,7 +314,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
                                                    req->sq->dhchap_c1,
                                                    challenge, shash_len);
                if (ret)
-                       goto out_free_response;
+                       goto out_free_challenge;
        }
 
        pr_debug("ctrl %d qid %d host response seq %u transaction %d\n",
@@ -325,7 +325,7 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
                        GFP_KERNEL);
        if (!shash) {
                ret = -ENOMEM;
-               goto out_free_response;
+               goto out_free_challenge;
        }
        shash->tfm = shash_tfm;
        ret = crypto_shash_init(shash);
@@ -361,9 +361,10 @@ int nvmet_auth_host_hash(struct nvmet_req *req, u8 *response,
                goto out;
        ret = crypto_shash_final(shash, response);
 out:
+       kfree(shash);
+out_free_challenge:
        if (challenge != req->sq->dhchap_c1)
                kfree(challenge);
-       kfree(shash);
 out_free_response:
        nvme_auth_free_key(transformed_key);
 out_free_tfm:
@@ -427,14 +428,14 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response,
                                                    req->sq->dhchap_c2,
                                                    challenge, shash_len);
                if (ret)
-                       goto out_free_response;
+                       goto out_free_challenge;
        }
 
        shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(shash_tfm),
                        GFP_KERNEL);
        if (!shash) {
                ret = -ENOMEM;
-               goto out_free_response;
+               goto out_free_challenge;
        }
        shash->tfm = shash_tfm;
 
@@ -471,9 +472,10 @@ int nvmet_auth_ctrl_hash(struct nvmet_req *req, u8 *response,
                goto out;
        ret = crypto_shash_final(shash, response);
 out:
+       kfree(shash);
+out_free_challenge:
        if (challenge != req->sq->dhchap_c2)
                kfree(challenge);
-       kfree(shash);
 out_free_response:
        nvme_auth_free_key(transformed_key);
 out_free_tfm: