lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 140/846] crypto: qce - fix uaf on qce_skcipher_register_one
    Date
    From: Chengfeng Ye <cyeaa@connect.ust.hk>

    [ Upstream commit e9c195aaeed1b45c9012adbe29dedb6031e85aa8 ]

    Pointer alg points to sub field of tmpl, it
    is dereferenced after tmpl is freed. Fix
    this by accessing alg before free tmpl.

    Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
    Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
    Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/crypto/qce/skcipher.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
    index 8ff10928f581d..3d27cd5210ef5 100644
    --- a/drivers/crypto/qce/skcipher.c
    +++ b/drivers/crypto/qce/skcipher.c
    @@ -484,8 +484,8 @@ static int qce_skcipher_register_one(const struct qce_skcipher_def *def,

    ret = crypto_register_skcipher(alg);
    if (ret) {
    - kfree(tmpl);
    dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
    + kfree(tmpl);
    return ret;
    }

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 23:09    [W:4.679 / U:0.536 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site