Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 18 Jul 2022 14:10:45 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Hannes Reinecke <hare@suse.de>
Cc:     linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
        linux-nvme@lists.infradead.org
Subject: [PATCH] nvme-auth: Uninitialized variable in
 nvme_auth_transform_key()
Message-ID: <YtU/tS/E2W9m+aau@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YtU/bFMYRCrx6tgp@kili>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ggkOunIjeqAidhq0YDajuc7+bkj2ZwZ2IJk6P+2HxFXxPQ/V+9DEyDqgoPCx?=
 =?us-ascii?Q?a8JpyIvp/OkNYQ9qvv1mio7FMpUNtC9nSHhxxVGK3gRfu5ROwLqxXBOhaOWV?=
 =?us-ascii?Q?rtzqwAJ8TnBBRkU3fuNuAZCBSpMIVRW3flchjBawTgo9PVc/1djLwY4QSwNH?=
 =?us-ascii?Q?tUKcWvzcwZcud75pDl9dxgAvT0GrO9YPSCY16GbQ5bC9cFoeuFDveCnid4Gu?=
 =?us-ascii?Q?38h6jmaQURZib7d4UHYx3+Mwxgnr+SyEfRfJGj9VbFSiFmHIyIel6mpWcnvr?=
 =?us-ascii?Q?DWJbhn4U1WyBvsW80BuCTuRQZxchKVKv7tS9qTmlq6Qqx4cQEElOm6W82THt?=
 =?us-ascii?Q?ziYcVPs9ZkdgB51M5kIxxzaj53o9s1W20zgTNHwkV01io8056ghy+v1ZSrRc?=
 =?us-ascii?Q?nUX/QR2DskWuy7B3bBzjel6SIZFECpS2EZiQivvMN3hFIT3eYUu7YlJlUdbg?=
 =?us-ascii?Q?cACAKph2fhoocmGn/ts96cwTgFLf3GXRzWqxceOmXuqJ25+aiU0y/ZXNRszf?=
 =?us-ascii?Q?NdZDR5c/fa9BiFX8dWtP+EtH+5/rQ/aBLbDxBlQ+peRaKbiYvvlYgrM5RkwF?=
 =?us-ascii?Q?XDS8cIxSQY71OvkBpQaHJiOZOSsgifOmNteoH0TE1ovBK+WsVAXUrZvMsUdi?=
 =?us-ascii?Q?p3A8dYvcMARmmjN81nGscF5mIZS0mV/CxCOIdw06VsYs+eEgerPdrfoqLDLN?=
 =?us-ascii?Q?OR+gHcRs3c3uo0BLCNfDwwLlm63/vCTfWzxv2WWAsUm4qNnKNmrHHazjn91J?=
 =?us-ascii?Q?vl+NpPYS2EtHDj3DWCDd7mgT5kYgol07Itv15fxNKxV977fSd3/WO7OOyyOG?=
 =?us-ascii?Q?KupGaZ5r5nQt0fjamDDx81IjKRf8DRihmFlHaLewOD4YM7isZlr5Wfg7vpRl?=
 =?us-ascii?Q?1Sy3Cl/z9sxd24K8SPOhHCxbB81mSWbymUlf0IEqcwevPa0Sc/yIGfyi4ydZ?=
 =?us-ascii?Q?hLM/xAXwHMFxa7cuveY4OgfpAqbu3ngHv/x9oM0LMlNlnreqKx468LuqOYFU?=
 =?us-ascii?Q?OLHR22XorL5t6VeeELbVcUmdK8MiH8r2frsJV5RxMsTbcLeHI6MjeAcDn0KX?=
 =?us-ascii?Q?Eh4R/XHW/XU33TcCClMuIHlA3dMSMMOViBffsGt/HMcOF00lnVgYwp81lZBN?=
 =?us-ascii?Q?I0UPcyBLrXY8H/z+d4/uN5mcO3h7EeGQ9gbrWdQPs8CZ3m/umi583W7X/mIp?=
 =?us-ascii?Q?1HDpdrISw9t1GbLraYvtbL1TaFUEQLpCdD7CgSqQCu+zgSjSbRIvYHrsueN6?=
 =?us-ascii?Q?+HzP5iOhoQiOs421cL/eZ/uQPtczHw2aeCX0M+Aygu5x21OoGR37M6k9Msjk?=
 =?us-ascii?Q?M8tzs+ekHbSB1dOtrrgOwWUwrbAqKuxmccKjSeNw+0Qgiq69b25zTGeA78Ht?=
 =?us-ascii?Q?F/Zjc4TawYY6zUpNjVJgcDL6LGENptwTRr74qBUEwPOhAMaMYrWSe6oOAKss?=
 =?us-ascii?Q?+xMX1DAJlRKryjVXS2kr1Ohx2arNvu2I4xiH6a8QXG3FzkUCJKhULV6KKM2V?=
 =?us-ascii?Q?L1peCuih0dwpJyo/wF2pJifiTeelasIClF3FEWlxZcbPFZzqcDoMxECKq1V9?=
 =?us-ascii?Q?gX46qQBUQNU7+I5eBocoaniHAlusZ1ftQ0nBykPhpqwKbCCOAl4e+949k9I1?=
 =?us-ascii?Q?ig=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 938b8598-314f-4080-64f2-08da68ae2ea2
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jul 2022 11:10:54.3589
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9k7yxMIpibu17zlwqN+GgHpzh+YLJwlXvvQCyZGSLSGaPb6MHnb+5C3EKqZL2PhJE4hEsZVzF5xbDehgkPlDmTvqP0V1utdVCoUitf2Nj2U=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4674
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-07-18_10,2022-07-18_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0
 mlxlogscore=999 spamscore=0 malwarescore=0 bulkscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2207180048
X-Proofpoint-GUID: igftHXbMXlHoj1RlzzTll0-eIdbkmie8
X-Proofpoint-ORIG-GUID: igftHXbMXlHoj1RlzzTll0-eIdbkmie8
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

A couple of the early error gotos call kfree_sensitive(transformed_key);
before "transformed_key" has been initialized.

Fixes: a476416bb57b ("nvme: implement In-Band authentication")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I wrote this several times in different ways, and kept on doing it
wrong so in the end I wrote it this way.  It's a bigger diff, but I
think it's the clearest way to write it.

 drivers/nvme/common/auth.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c
index bfb16fec0aed..1890193c7333 100644
--- a/drivers/nvme/common/auth.c
+++ b/drivers/nvme/common/auth.c
@@ -278,26 +278,33 @@ u8 *nvme_auth_transform_key(struct nvme_dhchap_key *key, char *nqn)
 	shash->tfm = key_tfm;
 	ret = crypto_shash_setkey(key_tfm, key->key, key->len);
 	if (ret < 0)
-		goto out_free_shash;
+		goto out_free_transformed_key;
 	ret = crypto_shash_init(shash);
 	if (ret < 0)
-		goto out_free_shash;
+		goto out_free_transformed_key;
 	ret = crypto_shash_update(shash, nqn, strlen(nqn));
 	if (ret < 0)
-		goto out_free_shash;
+		goto out_free_transformed_key;
 	ret = crypto_shash_update(shash, "NVMe-over-Fabrics", 17);
 	if (ret < 0)
-		goto out_free_shash;
+		goto out_free_transformed_key;
 	ret = crypto_shash_final(shash, transformed_key);
+	if (ret < 0)
+		goto out_free_transformed_key;
+
+	kfree(shash);
+	crypto_free_shash(key_tfm);
+
+	return transformed_key;
+
+out_free_transformed_key:
+	kfree_sensitive(transformed_key);
 out_free_shash:
 	kfree(shash);
 out_free_key:
 	crypto_free_shash(key_tfm);
-	if (ret < 0) {
-		kfree_sensitive(transformed_key);
-		return ERR_PTR(ret);
-	}
-	return transformed_key;
+
+	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(nvme_auth_transform_key);
 
-- 
2.35.1