lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 094/563] crypto: qce - fix uaf on qce_ahash_register_one
    Date
    From: Chengfeng Ye <cyeaa@connect.ust.hk>

    [ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ]

    Pointer base points to sub field of tmpl, it
    is dereferenced after tmpl is freed. Fix
    this by accessing base before free tmpl.

    Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
    Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
    Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/crypto/qce/sha.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
    index 87be96a0b0bba..8b4e79d882af4 100644
    --- a/drivers/crypto/qce/sha.c
    +++ b/drivers/crypto/qce/sha.c
    @@ -533,8 +533,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def,

    ret = crypto_register_ahash(alg);
    if (ret) {
    - kfree(tmpl);
    dev_err(qce->dev, "%s registration failed\n", base->cra_name);
    + kfree(tmpl);
    return ret;
    }

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 22:41    [W:2.369 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site