summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTom Rix <trix@redhat.com>2022-02-14 18:05:41 -0800
committerDavid S. Miller <davem@davemloft.net>2022-02-15 14:54:40 +0000
commit7e5b6a5c8c44310784c88c1c198dde79f6402f7b (patch)
tree89c5e52eda180af2545df6a5906da19831a26e59
parentef57640575406f57f5b3393cf57f457b0ace837e (diff)
downloadlinux-7e5b6a5c8c44310784c88c1c198dde79f6402f7b.tar.gz
linux-7e5b6a5c8c44310784c88c1c198dde79f6402f7b.tar.bz2
linux-7e5b6a5c8c44310784c88c1c198dde79f6402f7b.zip
mctp: fix use after free
Clang static analysis reports this problem route.c:425:4: warning: Use of memory after it is freed trace_mctp_key_acquire(key); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ When mctp_key_add() fails, key is freed but then is later used in trace_mctp_key_acquire(). Add an else statement to use the key only when mctp_key_add() is successful. Fixes: 4f9e1ba6de45 ("mctp: Add tracepoints for tag/key handling") Signed-off-by: Tom Rix <trix@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/mctp/route.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/net/mctp/route.c b/net/mctp/route.c
index 8d9f4ff3e285..e52cef750500 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -412,13 +412,14 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb)
* this function.
*/
rc = mctp_key_add(key, msk);
- if (rc)
+ if (rc) {
kfree(key);
+ } else {
+ trace_mctp_key_acquire(key);
- trace_mctp_key_acquire(key);
-
- /* we don't need to release key->lock on exit */
- mctp_key_unref(key);
+ /* we don't need to release key->lock on exit */
+ mctp_key_unref(key);
+ }
key = NULL;
} else {