From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     thara.gopinath@linaro.org, herbert@gondor.apana.org.au,
        davem@davemloft.net, svarbanov@mm-sol.com
Cc:     linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-arm-msm@vger.kernel.org, Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] crypto: qce: fix uaf on qce_ahash_register_one
Date:   Thu,  4 Nov 2021 06:38:31 -0700
Message-Id: <20211104133831.20049-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?nBKfJPxp51x5XiPpk8ch2Xt2VoUBJuqSs5VnIiwzXW3Op3xS9ekPbz6y4awC?=
 =?us-ascii?Q?jjj2mYimbSluyT2rHx3uD5EcaQ4AOI1ywYvwflF+BeRmzBx4gdayD3r3nzSt?=
 =?us-ascii?Q?7YyJDuFV9KqjuAsMW/HXdw2swWfcY+g9li9bdPW6FWPGy/s3EzVbY2e8mIZY?=
 =?us-ascii?Q?Q4/L4zYdlXKonTXTEHJ4b+s88mRt8MupcXYnl78Tv6ODCAEVCSJC8QUYUyBZ?=
 =?us-ascii?Q?9HGyeGmIONZHLM0WzIXKG8hjZXiHETrDkn3TD8RaIA7iQFqUjEgWOTBYkTYi?=
 =?us-ascii?Q?fFG7XU5C9FaRHfLXkSMmcofXH2gRyYmiMAMtOOVg4TSqY1qn9yQKVMIeRVxL?=
 =?us-ascii?Q?Z+2bszxCSiMzpCduSsJzbs3ZpMyrufnI4vZ4aCMW6hzTolsA8QDMLOOZTrIo?=
 =?us-ascii?Q?awQF7XLmAnxpeBSH5KsiZM4GxzBhSgRTg1uDFcqHdnm+pfmaJEnJ02HbjQe7?=
 =?us-ascii?Q?LXYcL0S1QHTgtm1AwvxvgpuuTfXWk13lhdw6mge02fT3aL6bE75HVgqVzEAY?=
 =?us-ascii?Q?6f+YQ1AmUcbf8BE8zl0wIFRrtpN7aspqCDG1Jv4WCL/q7nndk9KuyKsFngmV?=
 =?us-ascii?Q?PHPhxuXMUnKipTE8wuNquBpV2Is/n1alEcIXd62oFLIInwzp6y+/LVB0kaNt?=
 =?us-ascii?Q?DKCBDw/4W+KbPRrMSPYg0YIVcteVMBkz2NPAVUrx4AsCILXi8Oi6S1gB15BT?=
 =?us-ascii?Q?KKfGE6S0/1hUFdJx9UvQJ2TBlDXrdfLic3j878cDIF4k0tgaRdnE07TCNhQY?=
 =?us-ascii?Q?Jm+GkKfnDr1Bmwi8YMLtbGhEhwCHmjVMHRWLNqcLc8FGNLxrBo6Av1YdmIym?=
 =?us-ascii?Q?C8pmcJA4p3mPbAe081Dd7fhrhfFth5okX8+kBHgBcVnimktDVJ3RUynGMFVL?=
 =?us-ascii?Q?N5y2YRKppadbKxmDFTBPVmhQp/5+oBO0m13OuzeWAqUErmD22U0P+wiiqcRu?=
 =?us-ascii?Q?b8HKZiH4bDt03U48cI63jWz4EV4DfctSXvPSjlbAHOQzoVnc5u/0bRCjZ1E0?=
 =?us-ascii?Q?pmTkdpdb4dw0pqKcsX5B3bmnNvAiY3a3cN98YTPJgeesqY0xiOGKxtLCxvqA?=
 =?us-ascii?Q?X9LCEiur0pytfLEsHmhl2C94TJYPqBCRtCvPq0Ck/uX4vaeZ2zOGPj+hz4Hv?=
 =?us-ascii?Q?bQ3JFf7I3xg5BnqjnTFL2/ifo1rhxTzzdK8xr8Tbc10+Z8k6Bt3CYN2Ajajc?=
 =?us-ascii?Q?PBEvL1n3fL4PqJxUb/ngY6/Q4MHMHzp0Amf3xcc87YwTcsJdwajikmnSVzFf?=
 =?us-ascii?Q?wZqTYw1/pOr1k9fTwbi04ORjQD/yvbeItMJj5uHNmXoXqLOU8EyqsqdKBTWL?=
 =?us-ascii?Q?2DBY7jpWJD+ii/uLkjUMAO4HhIP9KGu4iNqitnf+FJnUBCFAiGjjA0XRvBq0?=
 =?us-ascii?Q?2G+a6f+sXn2IC3pJWfl8vQyh29Si5J+fo3djSkmtNq2lMGIzQh9ThBUtJcAX?=
 =?us-ascii?Q?qoxlIC/id8GNmODQG1dXjGV74we6/ZBmmUDQQgbbVIjJom7pUVpxPn6VxDzr?=
 =?us-ascii?Q?bupS5SNJFflNqfYu3pnpMjCOI+5J3IiO64bHdIDaLlxDGhiNxrAKishKwP4c?=
 =?us-ascii?Q?MockPr/HKnUPWxAwBjcsjlPHjSqr0UkDsmYe26vyAXWLX2fY4R2FnIyv2qTR?=
 =?us-ascii?Q?p6EhzgHDke4zfaQiOzlxmcA=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 87a7b4bf-09aa-41db-c4fa-08d99f9869ca
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2021 13:38:40.9681
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 7Dgy7Mt9y1AFF2pmOPEcEa8B49WWePeNlQ7qnA1dPIZdAtZK8+DUcuvHizuHihdKws78pTqFzqEWGTmhknr/hQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYCP286MB0830
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Pointer base points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing base before free tmpl.

Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/crypto/qce/sha.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c
index 8e6fcf2c21cc..59159f5e64e5 100644
--- a/drivers/crypto/qce/sha.c
+++ b/drivers/crypto/qce/sha.c
@@ -498,8 +498,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def,
 
 	ret = crypto_register_ahash(alg);
 	if (ret) {
-		kfree(tmpl);
 		dev_err(qce->dev, "%s registration failed\n", base->cra_name);
+		kfree(tmpl);
 		return ret;
 	}
 
-- 
2.17.1