Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Zheng Bin <zhengbin13@huawei.com>
To:     <herbert@gondor.apana.org.au>, <davem@davemloft.net>,
        <smueller@chronox.de>, <linux-crypto@vger.kernel.org>
CC:     <zhengbin13@huawei.com>
Subject: [PATCH] crypto: drbg - Fix memleak in drbg_prepare_hrng
Date:   Thu, 11 Jun 2020 16:33:56 +0800
Message-ID: <20200611083356.88600-1-zhengbin13@huawei.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7BIT
Content-Type:   text/plain; charset=US-ASCII
Sender: linux-crypto-owner@vger.kernel.org
Precedence: bulk

drbg_prepare_hrng
  drbg->jent = crypto_alloc_rng
  err = add_random_ready_callback
  default:
    drbg->random_ready.func = NULL  -->set NULL, if fail

drbg_uninstantiate
  if (drbg->random_ready.func)      -->If NULL, will not free drbg->jent
    crypto_free_rng(drbg->jent)

Need to free drbg->jent if add_random_ready_callback return fail.

Fixes: 97f2650e5040 ("crypto: drbg - always seeded with SP800-90B compliant noise source")
Signed-off-by: Zheng Bin <zhengbin13@huawei.com>
---
 crypto/drbg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/drbg.c b/crypto/drbg.c
index 37526eb8c5d5..a643ab7eac7a 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -1524,6 +1524,8 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
 		/* fall through */

 	default:
+		crypto_free_rng(drbg->jent);
+		drbg->jent = NULL;
 		drbg->random_ready.func = NULL;
 		return err;
 	}
--
2.26.0.106.g9fadedd