|
Takashi Iwai |
e284fa |
From 4a9dbd021970ffe1b92521328377b699acba7c52 Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
e284fa |
From: Chengfeng Ye <cyeaa@connect.ust.hk>
|
|
Takashi Iwai |
e284fa |
Date: Thu, 4 Nov 2021 06:28:07 -0700
|
|
Takashi Iwai |
e284fa |
Subject: [PATCH] crypto: qce - fix uaf on qce_aead_register_one
|
|
Takashi Iwai |
e284fa |
Git-commit: 4a9dbd021970ffe1b92521328377b699acba7c52
|
|
Takashi Iwai |
e284fa |
Patch-mainline: v5.17-rc1
|
|
Takashi Iwai |
e284fa |
References: git-fixes
|
|
Takashi Iwai |
e284fa |
|
|
Takashi Iwai |
e284fa |
Pointer alg points to sub field of tmpl, it
|
|
Takashi Iwai |
e284fa |
is dereferenced after tmpl is freed. Fix
|
|
Takashi Iwai |
e284fa |
this by accessing alg before free tmpl.
|
|
Takashi Iwai |
e284fa |
|
|
Takashi Iwai |
e284fa |
Fixes: 9363efb4 ("crypto: qce - Add support for AEAD algorithms")
|
|
Takashi Iwai |
e284fa |
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
|
|
Takashi Iwai |
e284fa |
Acked-by: Thara Gopinath <thara.gopinath@linaro.org>
|
|
Takashi Iwai |
e284fa |
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
|
Takashi Iwai |
e284fa |
Acked-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
e284fa |
|
|
Takashi Iwai |
e284fa |
---
|
|
Takashi Iwai |
e284fa |
drivers/crypto/qce/aead.c | 2 +-
|
|
Takashi Iwai |
e284fa |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
Takashi Iwai |
e284fa |
|
|
Takashi Iwai |
e284fa |
diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
|
|
Takashi Iwai |
e284fa |
index 290e2446a2f3..97a530171f07 100644
|
|
Takashi Iwai |
e284fa |
--- a/drivers/crypto/qce/aead.c
|
|
Takashi Iwai |
e284fa |
+++ b/drivers/crypto/qce/aead.c
|
|
Takashi Iwai |
e284fa |
@@ -802,8 +802,8 @@ static int qce_aead_register_one(const struct qce_aead_def *def, struct qce_devi
|
|
Takashi Iwai |
e284fa |
|
|
Takashi Iwai |
e284fa |
ret = crypto_register_aead(alg);
|
|
Takashi Iwai |
e284fa |
if (ret) {
|
|
Takashi Iwai |
e284fa |
- kfree(tmpl);
|
|
Takashi Iwai |
e284fa |
dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
|
|
Takashi Iwai |
e284fa |
+ kfree(tmpl);
|
|
Takashi Iwai |
e284fa |
return ret;
|
|
Takashi Iwai |
e284fa |
}
|
|
Takashi Iwai |
e284fa |
|
|
Takashi Iwai |
e284fa |
--
|
|
Takashi Iwai |
e284fa |
2.31.1
|
|
Takashi Iwai |
e284fa |
|