crypto: api - check for ERR pointers in crypto_destroy_tfm()

PATCH Superseded Ard Biesheuvel 2 participants 2 messages Feb 28, 2021 – Mar 1, 2021 Crypto API

Share & tools

Ard Biesheuvel

author

2021-02-28 12:29 UTC #0 lore raw

PATCH 1/1 crypto: api - check for ERR pointers in crypto_destroy_tfm()

Given that crypto_alloc_tfm() may return ERR pointers, and to avoid crashes on obscure error paths where such pointers are presented to crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there before dereferencing the second argument as a struct crypto_tfm pointer.

[0] https://lore.kernel.org/linux-crypto/[email protected]/

Reported-by [email protected]

Signed-off-by Ard Biesheuvel <[email protected]>

---
 crypto/api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

crypto/api.c +1 -1

index ed08cbd5b9d3..c4eda56cff89 100644
@@ -562,7 +562,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm)
 {
 	struct crypto_alg *alg;
 
-	if (unlikely(!mem))
+	if (IS_ERR_OR_NULL(mem))
 		return;
 
 	alg = tfm->__crt_alg;

Signature · 1 line

2.30.1

Eric Biggers

2021-03-01 20:37 UTC #1 lore raw

Quoted 19 lines · Ard Biesheuvel

Given that crypto_alloc_tfm() may return ERR pointers, and to avoid crashes on obscure error paths where such pointers are presented to crypto_destroy_tfm() (such as [0]), add an ERR_PTR check there before dereferencing the second argument as a struct crypto_tfm pointer.
[0] https://lore.kernel.org/linux-crypto/[email protected]/
Reported-by [email protected]
Signed-off-by Ard Biesheuvel <[email protected]>
---
 crypto/api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/api.c +0 -0
index ed08cbd5b9d3..c4eda56cff89 100644

crypto/api.c void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm) · line 568

Quoted 8 lines

crypto/api.c +1 -1

@@ -562,7 +562,7 @@ void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm)
 {
 	struct crypto_alg *alg;
 
-	if (unlikely(!mem))
+	if (IS_ERR_OR_NULL(mem))
 		return;
 
 	alg = tfm->__crt_alg;

Could you update the comments for the functions which call crypto_destroy_tfm() (crypto_free_aead(), crypto_free_skcipher(), etc.) to mention that they do nothing when passed NULL or an ERR_PTR()?

- Eric