From: Weili Qian <qianweili@huawei.com> In wd_rsa.c create_sess_key, prikey is allocated via sess->mm_ops.alloc which may be backed by mmap (WD_MMAP_MEM), but the pubkey alloc failure path freed it with free(), causing undefined behavior on mmap memory. Use sess->mm_ops.free to match the allocator and the normal release path in del_sess_key. Signed-off-by: Weili Qian <qianweili@huawei.com> --- wd_rsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wd_rsa.c b/wd_rsa.c index c1f2d9a..59c230d 100644 --- a/wd_rsa.c +++ b/wd_rsa.c @@ -930,7 +930,7 @@ static int create_sess_key(struct wd_rsa_sess_setup *setup, (int)GEN_PARAMS_SZ(sess->key_size); sess->pubkey = sess->mm_ops.alloc(sess->mm_ops.usr, len); if (!sess->pubkey) { - free(sess->prikey); + sess->mm_ops.free(sess->mm_ops.usr, sess->prikey); WD_ERR("failed to alloc sess pubkey!\n"); return -WD_ENOMEM; } -- 2.50.1.windows.1