diff options
| author | Tom Rix <trix@redhat.com> | 2022-02-15 05:05:41 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-02-15 17:54:40 +0300 |
| commit | 7e5b6a5c8c44310784c88c1c198dde79f6402f7b (patch) | |
| tree | 89c5e52eda180af2545df6a5906da19831a26e59 /net/mctp/route.c | |
| parent | ef57640575406f57f5b3393cf57f457b0ace837e (diff) | |
| download | linux-7e5b6a5c8c44310784c88c1c198dde79f6402f7b.tar.xz | |
mctp: fix use after free
Clang static analysis reports this problem
route.c:425:4: warning: Use of memory after it is freed
trace_mctp_key_acquire(key);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
When mctp_key_add() fails, key is freed but then is later
used in trace_mctp_key_acquire(). Add an else statement
to use the key only when mctp_key_add() is successful.
Fixes: 4f9e1ba6de45 ("mctp: Add tracepoints for tag/key handling")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mctp/route.c')
| -rw-r--r-- | net/mctp/route.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/net/mctp/route.c b/net/mctp/route.c index 8d9f4ff3e285..e52cef750500 100644 --- a/net/mctp/route.c +++ b/net/mctp/route.c @@ -412,13 +412,14 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) * this function. */ rc = mctp_key_add(key, msk); - if (rc) + if (rc) { kfree(key); + } else { + trace_mctp_key_acquire(key); - trace_mctp_key_acquire(key); - - /* we don't need to release key->lock on exit */ - mctp_key_unref(key); + /* we don't need to release key->lock on exit */ + mctp_key_unref(key); + } key = NULL; } else { |