Commit 83681f2b authored Mar 02, 2021 by Ard Biesheuvel Committed by Herbert Xu Mar 13, 2021

crypto: api - check for ERR pointers in crypto_destroy_tfm()

Given that crypto_alloc_tfm() may return ERR pointers, and to avoid
crashes on obscure error paths where such pointers are presented to
crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there
before dereferencing the second argument as a struct crypto_tfm
pointer.

[0] https://lore.kernel.org/linux-crypto/000000000000de949705bc59e0f6@google.com/



Reported-by:  <syzbot+12cf5fbfdeba210a89dd@syzkaller.appspotmail.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent 98b5ef3e

crypto/api.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -562,7 +562,7 @@ void crypto_destroy_tfm(void mem, struct crypto_tfm tfm)
		{
		struct crypto_alg *alg;

		if (unlikely(!mem))
		if (IS_ERR_OR_NULL(mem))
		return;

		alg = tfm->__crt_alg;

include/crypto/acompress.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -165,6 +165,8 @@ static inline struct crypto_acomp crypto_acomp_reqtfm(struct acomp_req req)
		* crypto_free_acomp() -- free ACOMPRESS tfm handle
		*
		* @tfm: ACOMPRESS tfm handle allocated with crypto_alloc_acomp()
		*
		* If @tfm is a NULL or error pointer, this function does nothing.
		*/
		static inline void crypto_free_acomp(struct crypto_acomp *tfm)
		{

include/crypto/aead.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -185,6 +185,8 @@ static inline struct crypto_tfm crypto_aead_tfm(struct crypto_aead tfm)
		/**
		* crypto_free_aead() - zeroize and free aead handle
		* @tfm: cipher handle to be freed
		*
		* If @tfm is a NULL or error pointer, this function does nothing.
		*/
		static inline void crypto_free_aead(struct crypto_aead *tfm)
		{

include/crypto/akcipher.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -174,6 +174,8 @@ static inline struct crypto_akcipher *crypto_akcipher_reqtfm(
		* crypto_free_akcipher() - free AKCIPHER tfm handle
		*
		* @tfm: AKCIPHER tfm handle allocated with crypto_alloc_akcipher()
		*
		* If @tfm is a NULL or error pointer, this function does nothing.
		*/
		static inline void crypto_free_akcipher(struct crypto_akcipher *tfm)
		{

include/crypto/hash.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -281,6 +281,8 @@ static inline struct crypto_tfm crypto_ahash_tfm(struct crypto_ahash tfm)
		/**
		* crypto_free_ahash() - zeroize and free the ahash handle
		* @tfm: cipher handle to be freed
		*
		* If @tfm is a NULL or error pointer, this function does nothing.
		*/
		static inline void crypto_free_ahash(struct crypto_ahash *tfm)
		{
		@@ -724,6 +726,8 @@ static inline struct crypto_tfm crypto_shash_tfm(struct crypto_shash tfm)
		/**
		* crypto_free_shash() - zeroize and free the message digest handle
		* @tfm: cipher handle to be freed
		*
		* If @tfm is a NULL or error pointer, this function does nothing.
		*/
		static inline void crypto_free_shash(struct crypto_shash *tfm)
		{