Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Jonathan McDowell <noodles@fb.com>
To:     Jianglei Nie <niejianglei2021@163.com>
CC:     "jejb@linux.ibm.com" <jejb@linux.ibm.com>,
        "jarkko@kernel.org" <jarkko@kernel.org>,
        "zohar@linux.ibm.com" <zohar@linux.ibm.com>,
        "dhowells@redhat.com" <dhowells@redhat.com>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2] KEYS: trusted: Fix memory leak in tpm2_key_encode()
Thread-Topic: [PATCH v2] KEYS: trusted: Fix memory leak in tpm2_key_encode()
Thread-Index: AQHYezzkL7mbniGhFUCacTFHDtg8861Fg5oA
Date:   Wed, 8 Jun 2022 13:38:35 +0000
Message-ID: <YqCmVi3J10Tcx0Wk@noodles-fedora.dhcp.thefacebook.com>
References: <20220608131732.550234-1-niejianglei2021@163.com>
In-Reply-To: <20220608131732.550234-1-niejianglei2021@163.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?ekO8UsaN1OvWIXaNIIYaRPgrB1lSv6sFEvzJ8DjGMxNk24EeAJ4vA19GB9lp?=
 =?us-ascii?Q?Oo1C8Pco6pD5Af7LLlnq1Qfya9iXnKaIhgjsHmP2YBgf0fz2Bfj44dyU4Ley?=
 =?us-ascii?Q?CuwDq/SlIEzsL4wsVc5jF+jXp+QXIlU4TiJrn77S9tAwKI3qPWNtrht6Q4bR?=
 =?us-ascii?Q?1Dob357M037SkwA/jvAP1/V+XDU+ahsYDK710yLdCvCzPtjiXvopsc/5QqNN?=
 =?us-ascii?Q?ys0MNSWNtJRqT7N5v+BgL1Rlt8yCBwJm9FExwxUeYyI2fkUrOqTQHURlUdpR?=
 =?us-ascii?Q?hiR706gUwnJTDiywLujp6IjkdjBTaLKKVVjtGdwPESuL8fM7v2UkGq+rbejA?=
 =?us-ascii?Q?rCsvUADL3XT7+7b1ytDI3vAKe0zsJrBaGOqx1PbMF/tJQgvP9L3SEHOmi4l7?=
 =?us-ascii?Q?RLG0SUc4WYQnXjmZ6tHbIsLFQ+eC96FN/Wh249DiSh1dn2UzXN+xcJCcjtcA?=
 =?us-ascii?Q?0oJAFKrq6cI7ryhdw/k47VSV8U/bFd+lDyhRNMdoojXXNva1j2gKmcOR3UOQ?=
 =?us-ascii?Q?eXArFPDArxVMHn/IhA8OcQ/ciX/cPAeZ09pBk97mzmRgb98j63yfm3AIsT6s?=
 =?us-ascii?Q?XrUwAduW4SuaYOOaCSyxNVd1BMedERqJAfvAQ+IHs30jsES0ToSl1WNiMVST?=
 =?us-ascii?Q?iQBcUrO9h6zdw8zSVs+YIpCdLWJD6q8xDZXXJ9FB0UCaQHCnmzBhBYW+7oRA?=
 =?us-ascii?Q?LvF+d59cmeXbA4D0paBz6U9jgl9EcUq5d27WtPXxfMZ5rIOUd08z0BLbFuN3?=
 =?us-ascii?Q?nbslu5xJ+sGkPraooTpsS5/0jtUzdiI+zJo5QPIMny6Awiet9ItGCP0GAUGD?=
 =?us-ascii?Q?Tu7+kZVSfMKB7dWWREW0y5njIdw+5jnvD4fBRayUZH5XFtNVBin2Vv5ZuHeq?=
 =?us-ascii?Q?wT9JcDjopgWBKvslB15dn6bOS6kjF8w+GK9Srcr2wU3WV47ZTlEXqKntpgND?=
 =?us-ascii?Q?+e/Jsnl09oP70Ka/ivrHn6iv9bBYNkegdEQQ0cN1ksZUjh+PLLbo35XgCwrp?=
 =?us-ascii?Q?BGqTAfUjodZnQS/6kXS6L9udLvTFX87rCrPq9nwrOj1b5ureVv76RH4Ku0nr?=
 =?us-ascii?Q?mM/aNYTa9CLOXm0M5hWMFCS9VsWjeDp3bkl9EMI/0/SAf+tA0eEq0R2AppYA?=
 =?us-ascii?Q?eWouYclxCxw1hWAtV7zFqXAaxY4iAR2FUxGZ8kOwWVp85oBwXpliqFusi+Bl?=
 =?us-ascii?Q?ZxiwRcr22UjC1jorK1q3l5odZh7E9+kxXaXSYcuBunejCwNzLPa0fdFg0kWG?=
 =?us-ascii?Q?XvUzyv0LBGtVIkopAwdm2ywc47v8l8Lc4f2e6TzqRLi6xGj5qL3t4O02Aqgo?=
 =?us-ascii?Q?Qa7j4sf+2LB9TUdUEOOJJFjhLwvyWIqY9rHoDtxwp2ZvpZ17thxKln6hIxaK?=
 =?us-ascii?Q?zM44WroS0SdkVOXB9Qzwn0Cwcb8L25JtLQQkEaMwyRGPiazdn//Gh4XXf86m?=
 =?us-ascii?Q?e94GfeftqEeRG9zpz06oMfEBwzAm52SnGV49lz2RbvFyRjfYNYjbOPwTPUZN?=
 =?us-ascii?Q?Wf/9FsddBNCB3CZr7aME8/iQUmWE/tMt/03+ABvr8rRF5Tt1q++6ZVkm1HeB?=
 =?us-ascii?Q?CIiTC2nIRCQg0yPvckbKaatPA1p8n7p8+yLQYSbAwbjF8QGBV901HFjSUN2S?=
 =?us-ascii?Q?gVh1ZMUZomyfq+jeMkwG3kIH7SSIYKzmTE640zJvDSRxS/pd2WD4SlpGpLwf?=
 =?us-ascii?Q?GpFocpBHu73Q6F6NT7QI82yfErQvZhtVMKaqQzQrQpnRBt9QHxdm+0WZEFjr?=
 =?us-ascii?Q?pwgk1umFPA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <C21F05C868FD6640BA95D6CBAF08E452@namprd15.prod.outlook.com>
MIME-Version: 1.0
X-OriginatorOrg: fb.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR15MB4552.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e3f83d67-55ec-49dc-371a-08da49543000
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Jun 2022 13:38:35.7122
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 3wWKI8u6/PnVcsr1HhFrX5ZluzCMCy6gWMzcNe53wqhZXZTHvVRyWXwCM+DHT3ZV
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR15MB4166
X-Proofpoint-ORIG-GUID: Z9wUTYugkXmfQ_W1kvcNiflzqoDfh99X
X-Proofpoint-GUID: Z9wUTYugkXmfQ_W1kvcNiflzqoDfh99X
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.874,Hydra:6.0.517,FMLib:17.11.64.514
 definitions=2022-06-08_04,2022-06-07_02,2022-02-23_01
X-Spam-Status: No, score=-3.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Jun 08, 2022 at 09:17:32PM +0800, Jianglei Nie wrote:
> tpm2_key_encode() allocates a memory chunk from scratch with kmalloc(),
> but it is never freed, which leads to a memory leak. Free the memory
> chunk with kfree() in the return path.

This change only does the kfree in the success path; "out" just returns
the error without freeing the memory.

> Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
> ---
>  security/keys/trusted-keys/trusted_tpm2.c | 23 +++++++++++++++++------
>  1 file changed, 17 insertions(+), 6 deletions(-)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
> index 0165da386289..8b7ab22950d1 100644
> --- a/security/keys/trusted-keys/trusted_tpm2.c
> +++ b/security/keys/trusted-keys/trusted_tpm2.c
> @@ -32,6 +32,7 @@ static int tpm2_key_encode(struct trusted_key_payload *payload,
>  			   struct trusted_key_options *options,
>  			   u8 *src, u32 len)
>  {
> +	int err;
>  	const int SCRATCH_SIZE = PAGE_SIZE;
>  	u8 *scratch = kmalloc(SCRATCH_SIZE, GFP_KERNEL);
>  	u8 *work = scratch, *work1;
> @@ -57,8 +58,10 @@ static int tpm2_key_encode(struct trusted_key_payload *payload,
>  		unsigned char bool[3], *w = bool;
>  		/* tag 0 is emptyAuth */
>  		w = asn1_encode_boolean(w, w + sizeof(bool), true);
> -		if (WARN(IS_ERR(w), "BUG: Boolean failed to encode"))
> -			return PTR_ERR(w);
> +		if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) {
> +			err = PTR_ERR(w);
> +			goto out;
> +		}
>  		work = asn1_encode_tag(work, end_work, 0, bool, w - bool);
>  	}
>  
> @@ -69,8 +72,10 @@ static int tpm2_key_encode(struct trusted_key_payload *payload,
>  	 * trigger, so if it does there's something nefarious going on
>  	 */
>  	if (WARN(work - scratch + pub_len + priv_len + 14 > SCRATCH_SIZE,
> -		 "BUG: scratch buffer is too small"))
> -		return -EINVAL;
> +		 "BUG: scratch buffer is too small")) {
> +		err = -EINVAL;
> +		goto out;
> +	}
>  
>  	work = asn1_encode_integer(work, end_work, options->keyhandle);
>  	work = asn1_encode_octet_string(work, end_work, pub, pub_len);
> @@ -79,10 +84,16 @@ static int tpm2_key_encode(struct trusted_key_payload *payload,
>  	work1 = payload->blob;
>  	work1 = asn1_encode_sequence(work1, work1 + sizeof(payload->blob),
>  				     scratch, work - scratch);
> -	if (WARN(IS_ERR(work1), "BUG: ASN.1 encoder failed"))
> -		return PTR_ERR(work1);
> +	if (WARN(IS_ERR(work1), "BUG: ASN.1 encoder failed")) {
> +		err = -EINVAL;
> +		goto out;
> +	}
> +	kfree(scratch);
>  
>  	return work1 - payload->blob;
> +
> +out:
> +	return err;
>  }
>  
>  struct tpm2_key_context {
> -- 
> 2.25.1