Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH] net: ceph: Fix a possible null-pointer dereference in ceph_crypto_key_destroy() | Date | Wed, 24 Jul 2019 17:43:06 +0800 |
| |
In set_secret(), key->tfm is assigned to NULL on line 55, and then ceph_crypto_key_destroy(key) is executed.
ceph_crypto_key_destroy(key) crypto_free_sync_skcipher(key->tfm) crypto_skcipher_tfm(tfm) return &tfm->base;
Thus, a possible null-pointer dereference may occur.
To fix this bug, key->tfm is checked before calling crypto_free_sync_skcipher().
This bug is found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- net/ceph/crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c index 5d6724cee38f..ac28463bcfd8 100644 --- a/net/ceph/crypto.c +++ b/net/ceph/crypto.c @@ -136,7 +136,8 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key) if (key) { kfree(key->key); key->key = NULL; - crypto_free_sync_skcipher(key->tfm); + if (key->tfm) + crypto_free_sync_skcipher(key->tfm); key->tfm = NULL; } } -- 2.17.0
| |