Commit 3d950c34 authored by Jianglei Nie's avatar Jianglei Nie Committed by Herbert Xu
Browse files

crypto: ccree - Fix use after free in cc_cipher_exit() 



kfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But
ctx_p->user.key is still used in the next line, which will lead to a
use after free.

We can call kfree_sensitive() after dev_dbg() to avoid the uaf.

Fixes: 63ee04c8 ("crypto: ccree - add skcipher support")
Signed-off-by: default avatarJianglei Nie <niejianglei2021@163.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 54cce8ec

drivers/crypto/ccree/cc_cipher.c

+1 −1
Original line number Diff line number Diff line
@@ -257,8 +257,8 @@ static void cc_cipher_exit(struct crypto_tfm *tfm) 
		&ctx_p->user.key_dma_addr);



	/* Free key buffer in context */

	kfree_sensitive(ctx_p->user.key);

	dev_dbg(dev, "Free key buffer in context. key=@%p\n", ctx_p->user.key);

	kfree_sensitive(ctx_p->user.key);

}



struct tdes_keys {