nvmet-auth: always free derived key data

8edb86b2 · Hannes Reinecke <[email protected]> · 2025-04-25 11:34:34 +02:00

After calling nvme_auth_derive_tls_psk() we need to free the resulting
psk data, as either TLS is disable (and we don't need the data anyway)
or the psk data is copied into the resulting key (and can be free, too).

Fixes: fa2e0f8bbc68 ("nvmet-tcp: support secure channel concatenation")
Reported-by: Yi Zhang <[email protected]>
Suggested-by: Maurizio Lombardi <[email protected]>
Signed-off-by: Hannes Reinecke <[email protected]>
Reviewed-by: Sagi Grimberg <[email protected]>
Tested-by: Yi Zhang <[email protected]>
Signed-off-by: Christoph Hellwig <[email protected]>

Commit: 8edb86b2ed1d63cc400aecae8eb8c8114837171a
Parents: 46d22b47

Changes

1 files changed · +1 −2

File	Status	Add	Del	Content
drivers/nvme/target/auth.c	modified	+1	−2	View file

drivers/nvme/target/auth.c

View file

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index cef8d77..9429b82 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -600,13 +600,12 @@ void nvmet_auth_insert_psk(struct nvmet_sq *sq)
 		pr_warn("%s: ctrl %d qid %d failed to refresh key, error %ld\n",
 			__func__, sq->ctrl->cntlid, sq->qid, PTR_ERR(tls_key));
 		tls_key = NULL;
-		kfree_sensitive(tls_psk);
 	}
 	if (sq->ctrl->tls_key)
 		key_put(sq->ctrl->tls_key);
 	sq->ctrl->tls_key = tls_key;
 #endif
-
+	kfree_sensitive(tls_psk);
 out_free_digest:
 	kfree_sensitive(digest);
 out_free_psk: