提交 8a70209a 编写于 作者: J Jianglei Nie 提交者: Zheng Zengkai

crypto: ccree - Fix use after free in cc_cipher_exit()

stable inclusion
from stable-v5.10.110
commit c93017c8d5ebf55a4e453ac7c84cc84cf92ab570
bugzilla: https://gitee.com/openeuler/kernel/issues/I574AL

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c93017c8d5ebf55a4e453ac7c84cc84cf92ab570

--------------------------------

[ Upstream commit 3d950c34 ]

kfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But
ctx_p->user.key is still used in the next line, which will lead to a
use after free.

We can call kfree_sensitive() after dev_dbg() to avoid the uaf.

Fixes: 63ee04c8 ("crypto: ccree - add skcipher support")
Signed-off-by: NJianglei Nie <niejianglei2021@163.com>
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NYu Liao <liaoyu15@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 a3c5578f
...@@ -254,8 +254,8 @@ static void cc_cipher_exit(struct crypto_tfm *tfm) ...@@ -254,8 +254,8 @@ static void cc_cipher_exit(struct crypto_tfm *tfm)
&ctx_p->user.key_dma_addr); &ctx_p->user.key_dma_addr);
/* Free key buffer in context */ /* Free key buffer in context */
kfree_sensitive(ctx_p->user.key);
dev_dbg(dev, "Free key buffer in context. key=@%p\n", ctx_p->user.key); dev_dbg(dev, "Free key buffer in context. key=@%p\n", ctx_p->user.key);
kfree_sensitive(ctx_p->user.key);
} }
struct tdes_keys { struct tdes_keys {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册