From: Weili Qian <qianweili@huawei.com> Two error-path bugs cause undefined behavior on mmap memory and allow invalid column sizes to reach hardware DMA. In wd_rsa.c create_sess_key, prikey is allocated via sess->mm_ops.alloc which may be backed by mmap (WD_MMAP_MEM), but the pubkey alloc failure path freed it with free(), causing undefined behavior on mmap memory. Use sess->mm_ops.free to match the allocator and the normal release path in del_sess_key. wd_alg_init_fallback in wd_util.c discarded fb_driver->init() return value and always returned 0, and wd_agg_rehash_sync_inner in wd_agg.c ignored wd_agg_set_col_size return value, allowing invalid column sizes to hardware DMA. Propagate the init return value and check wd_agg_set_col_size so callers can detect failures. Signed-off-by: Weili Qian <qianweili@huawei.com> --- wd_agg.c | 4 +++- wd_rsa.c | 2 +- wd_util.c | 4 +--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/wd_agg.c b/wd_agg.c index 2c7825d..ed4ba74 100644 --- a/wd_agg.c +++ b/wd_agg.c @@ -1500,7 +1500,9 @@ static int wd_agg_rehash_sync_inner(struct wd_agg_sess *sess, struct wd_agg_req } out_req->real_out_row_count = msg.out_row_count; - wd_agg_set_col_size(sess, in_req, out_req->real_out_row_count); + ret = wd_agg_set_col_size(sess, in_req, out_req->real_out_row_count); + if (unlikely(ret)) + return ret; in_req->in_row_count = out_req->real_out_row_count; fill_request_msg_input(&in_msg, in_req, sess, true); diff --git a/wd_rsa.c b/wd_rsa.c index c1f2d9a..59c230d 100644 --- a/wd_rsa.c +++ b/wd_rsa.c @@ -930,7 +930,7 @@ static int create_sess_key(struct wd_rsa_sess_setup *setup, (int)GEN_PARAMS_SZ(sess->key_size); sess->pubkey = sess->mm_ops.alloc(sess->mm_ops.usr, len); if (!sess->pubkey) { - free(sess->prikey); + sess->mm_ops.free(sess->mm_ops.usr, sess->prikey); WD_ERR("failed to alloc sess pubkey!\n"); return -WD_ENOMEM; } diff --git a/wd_util.c b/wd_util.c index 0d482f9..b5eaa7d 100644 --- a/wd_util.c +++ b/wd_util.c @@ -1566,9 +1566,7 @@ static int wd_alg_init_fallback(struct wd_alg_driver *fb_driver) return -WD_EINVAL; } - fb_driver->init(NULL, NULL); - - return 0; + return fb_driver->init(NULL, NULL); } static void wd_alg_uninit_fallback(struct wd_alg_driver *fb_driver) -- 2.28.0.windows.1