[PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Zhang Qilong]

If dhchap_secret is not consistent with options or
nvme_auth_generate_key() fails, we should free the
memory of dhchap_secret to avoid memleak.

We fix it by changing the check strcmp to strncmp
directly against buf and moving allocating inside
to the clause.

Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
---
v2:
- changing checking function and allocating location.
---
 drivers/nvme/host/core.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index da55ce45ac70..bfec2a63d0d8 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3730,7 +3730,6 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
 {
 	struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
 	struct nvmf_ctrl_options *opts = ctrl->opts;
-	char *dhchap_secret;
 
 	if (!ctrl->opts->dhchap_secret)
 		return -EINVAL;
@@ -3739,17 +3738,19 @@ static ssize_t nvme_ctrl_dhchap_secret_store(struct device *dev,
 	if (memcmp(buf, "DHHC-1:", 7))
 		return -EINVAL;
 
-	dhchap_secret = kzalloc(count + 1, GFP_KERNEL);
-	if (!dhchap_secret)
-		return -ENOMEM;
-	memcpy(dhchap_secret, buf, count);
 	nvme_auth_stop(ctrl);
-	if (strcmp(dhchap_secret, opts->dhchap_secret)) {
+	if (strncmp(buf, opts->dhchap_secret, count)) {
 		int ret;
+		char *dhchap_secret;
 
+		dhchap_secret = kmemdup(buf);
+		if (!dhchap_secret)
+			return -ENOMEM;
 		ret = nvme_auth_generate_key(dhchap_secret, &ctrl->host_key);
-		if (ret)
+		if (ret) {
+			kfree(dhchap_secret);
 			return ret;
+		}
 		kfree(opts->dhchap_secret);
 		opts->dhchap_secret = dhchap_secret;
 		/* Key has changed; re-authentication with new key */
-- 
2.25.1

Re: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Sagi Grimberg]

Reviewed-by: Sagi Grimberg <sagi@grimberg.me>

Re: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Chaitanya Kulkarni]

On 11/21/22 20:49, Zhang Qilong wrote:
> If dhchap_secret is not consistent with options or
> nvme_auth_generate_key() fails, we should free the
> memory of dhchap_secret to avoid memleak.
> 
> We fix it by changing the check strcmp to strncmp
> directly against buf and moving allocating inside
> to the clause.
> 
> Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
> Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
> ---
> v2:
> - changing checking function and allocating location.
> ---
>
Looks good.

Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>

-ck

Re: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Christoph Hellwig]

Thanks,

applied to nvme-6.1.

Re: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Christoph Hellwig]

On Tue, Nov 29, 2022 at 09:47:25AM +0100, Christoph Hellwig wrote:
> Thanks,
> 
> applied to nvme-6.1.

And I had to fix it to actually pass all the correct paramters to
kmemdup, so it looks like this code wasn't even compile test.

Btw, how can nvme_ctrl_dhchap_secret_store work without any kind
of locking?

答复: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[zhangqilong]

> 
> On Tue, Nov 29, 2022 at 09:47:25AM +0100, Christoph Hellwig wrote:
> > Thanks,
> >
> > applied to nvme-6.1.
> 
> And I had to fix it to actually pass all the correct paramters to kmemdup, so it
> looks like this code wasn't even compile test.
> 
Oh, 

     It seems that I forget to do it for V2 version. I am sorry to it, It is so nice that you fix it.

> Btw, how can nvme_ctrl_dhchap_secret_store work without any kind of
> locking?

You means it should need a lock to avoid race condition?

Thanks!

Re: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Sagi Grimberg]

>> Thanks,
>>
>> applied to nvme-6.1.
> 
> And I had to fix it to actually pass all the correct paramters to
> kmemdup, so it looks like this code wasn't even compile test.
> 
> Btw, how can nvme_ctrl_dhchap_secret_store work without any kind
> of locking?

This is fixed in 6.2 with some of my patches.

Re: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[Christoph Hellwig]

On Wed, Nov 30, 2022 at 10:37:45AM +0200, Sagi Grimberg wrote:
> This is fixed in 6.2 with some of my patches.

And this version conflicts with that.

Zhang, can you please resend a fully tested version against the
nvme-6.2 branch?  Thanks!

答复: [PATCH v2] nvme: fix memleak in nvme_ctrl_dhchap_secret_store()

[zhangqilong]

> On Wed, Nov 30, 2022 at 10:37:45AM +0200, Sagi Grimberg wrote:
> > This is fixed in 6.2 with some of my patches.
> 
> And this version conflicts with that.
> 
> Zhang, can you please resend a fully tested version against the
> nvme-6.2 branch?  Thanks!

It is my pleasure to do that.
I will send a tested version to nvme-6.2 branch!

Thanks,
Zhang