lkml.org 
[lkml]   [2020]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 390/477] crypto: marvell/octeontx - Fix a potential NULL dereference
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 1f5b07f5dd1748a6f9363fb1a76d599c74af8231 ]

    Smatch reports that:

    drivers/crypto/marvell/octeontx/otx_cptvf_algs.c:132 otx_cpt_aead_callback()
    warn: variable dereferenced before check 'cpt_info' (see line 121)

    This function is called from process_pending_queue() as:

    drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
    599 /*
    600 * Call callback after current pending entry has been
    601 * processed, we don't do it if the callback pointer is
    602 * invalid.
    603 */
    604 if (callback)
    605 callback(res_code, areq, cpt_info);

    It does appear to me that "cpt_info" can be NULL so this could lead to
    a NULL dereference.

    Fixes: 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/crypto/marvell/octeontx/otx_cptvf_algs.c | 11 +++++++----
    1 file changed, 7 insertions(+), 4 deletions(-)

    diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c b/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
    index 06202bcffb33f..a370c99ecf4c9 100644
    --- a/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
    +++ b/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c
    @@ -118,6 +118,9 @@ static void otx_cpt_aead_callback(int status, void *arg1, void *arg2)
    struct otx_cpt_req_info *cpt_req;
    struct pci_dev *pdev;

    + if (!cpt_info)
    + goto complete;
    +
    cpt_req = cpt_info->req;
    if (!status) {
    /*
    @@ -129,10 +132,10 @@ static void otx_cpt_aead_callback(int status, void *arg1, void *arg2)
    !cpt_req->is_enc)
    status = validate_hmac_cipher_null(cpt_req);
    }
    - if (cpt_info) {
    - pdev = cpt_info->pdev;
    - do_request_cleanup(pdev, cpt_info);
    - }
    + pdev = cpt_info->pdev;
    + do_request_cleanup(pdev, cpt_info);
    +
    +complete:
    if (areq)
    areq->complete(areq, status);
    }
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-06-23 22:17    [W:4.122 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site