From: Vitaliy Shevtsov Date: Mon, 16 Sep 2024 17:41:37 +0000 (+0500) Subject: nvmet-auth: assign dh_key to NULL after kfree_sensitive X-Git-Tag: v6.12-rc6~21^2^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d2f551b1f72b4c508ab9298419f6feadc3b5d791;p=thirdparty%2Fkernel%2Flinux.git nvmet-auth: assign dh_key to NULL after kfree_sensitive ctrl->dh_key might be used across multiple calls to nvmet_setup_dhgroup() for the same controller. So it's better to nullify it after release on error path in order to avoid double free later in nvmet_destroy_auth(). Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 7a277c37d352 ("nvmet-auth: Diffie-Hellman key exchange support") Cc: stable@vger.kernel.org Signed-off-by: Vitaliy Shevtsov Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Keith Busch --- diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c index 7897d02c681da..b0fd211ec57ea 100644 --- a/drivers/nvme/target/auth.c +++ b/drivers/nvme/target/auth.c @@ -115,6 +115,7 @@ int nvmet_setup_dhgroup(struct nvmet_ctrl *ctrl, u8 dhgroup_id) pr_debug("%s: ctrl %d failed to generate private key, err %d\n", __func__, ctrl->cntlid, ret); kfree_sensitive(ctrl->dh_key); + ctrl->dh_key = NULL; return ret; } ctrl->dh_keysize = crypto_kpp_maxsize(ctrl->dh_tfm);