Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     thara.gopinath@linaro.org, herbert@gondor.apana.org.au,
        davem@davemloft.net
Cc:     linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-arm-msm@vger.kernel.org, Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] crypto: qce: fix uaf on qce_aead_register_one
Date:   Thu,  4 Nov 2021 06:28:07 -0700
Message-Id: <20211104132807.19366-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?gbIO92+Qq5MrIIRcenIqul57JeQFulkR9+tH3bHfdNeaDXXAMXH5K298ivfH?=
 =?us-ascii?Q?PoVZZyCtxj8r3Vv0AIr/ma/7aIT7mEhmHU2tmGfwo3lDj1zR0qX1nyQpEUK9?=
 =?us-ascii?Q?EW1sQORDuhec3tWij9FUeUlSkj237savvIESf84q181hpOGEkMV9pqI5sNZR?=
 =?us-ascii?Q?1dYNEm72ed/fLjZQzviLkRH70gghg04qKqc7VWEZIynhgi/7iedG1vWBjYxL?=
 =?us-ascii?Q?ss3LF3WzPnE5CHAuj1RlnwD1O3kHdk3QR9x11qQYNcr+hfZnskth3uu9dyxr?=
 =?us-ascii?Q?7gfLi8RrFiZv1/MGbWCTaSW0L4qLiP9ff+vXPIa+YcmwcyfgMhlig3/hq4du?=
 =?us-ascii?Q?e+aXwpos7jhk8XgoJ2wwB6cCH2hLChlkc/azxtZYt/YIRg4O2lC/P4+uEZ4s?=
 =?us-ascii?Q?+TNq/lanxAD7LxzK47VdJ4o0as/HED4sMZG084W0VVQ+GWxVsCn/pO9B3ef5?=
 =?us-ascii?Q?dCuPZz8oUHPoGPAKyXwBm3/2RoUIk8rkb6LpPx3G/xwqcVZbGAGdJpFdAubE?=
 =?us-ascii?Q?MrQHPpdCIZwRJme2f3NCl0AWTjkoVQPjIumMvdUyjnBIfXHBxiaw+Gg9pJJm?=
 =?us-ascii?Q?Mb/C0vz9xEKEMaTOMu6TsP97Z67QCwrwVKrUNUpf5MsQFr86j9CB0SJP1TaH?=
 =?us-ascii?Q?PKAYCcCZjX9/p8Adl9iU2SfpTG71L8hv91htLzuFzjfjjnL13VV8Nlp4bREf?=
 =?us-ascii?Q?YrYI3ZKrZgFPnbggLQ0mOp/VXIPw9D522S2C7MSqjHiWJzI6utpMuQTcgKMa?=
 =?us-ascii?Q?Rm4fZY1KoC/Hrs0gZdE08ItFl9XT2JBTyVZEhAq/7jwAOLZliJGpNPY87qzf?=
 =?us-ascii?Q?hnlcFfPEzGNT7eG6W7JvT1dkotoiB0WWWCnhirvHerJhZJamgbkuKOhDs8wM?=
 =?us-ascii?Q?xvQbm8Cz9kcTdUf3y0FQnQdqlUECzkrkzIPNem8Yuzw0fwT3JB3+/nFm423k?=
 =?us-ascii?Q?5huyJosBhODX30QGi4NrGhrzAlenlPERHQ99cNgh5P3LqIe2xSJWMlMrz/CB?=
 =?us-ascii?Q?uHpR9a6F8UwtsAQGgEhtmCoG8gzV68GB/aLIvBvg0L+p6cJvM7njvHtmCUbJ?=
 =?us-ascii?Q?AnVkk6ogIqXDgCSgNJG+TBt+So6NkuOICmFcN1Cn6EdL/85Ngdvm0SCsALU1?=
 =?us-ascii?Q?dUhe1mS6Jo4MG+MLNAtWYYP1Fz3ut2E+CpanbyVrji/mA3+eBnuL5J5um8qK?=
 =?us-ascii?Q?AgKResZ8U895kfyEpynPXMTfiY/ybKTyP3MpE2+EFt6/IXu9MsmmFkDv6u2k?=
 =?us-ascii?Q?FIXvWS3GJDFyWMDyMINX4LFRg6PmfCIg3upB10zl4eCtcXyNi4BWWO5f2vV2?=
 =?us-ascii?Q?lrXXZHUnSdLMtCZwUjuqb1OFeUKbr33zSOt7eEfMkL9j56SvI6k34k+xqY43?=
 =?us-ascii?Q?KM3A5AoUoauSSdzP7e2aR4oh7E4+mUS2VhUUdqNGX5Ssdo3oLto+SL66rRl4?=
 =?us-ascii?Q?kIUsowu9L6tc/M8UMFpHE4GLsv0OXPI7uimb5Kmc5DPN0COC+FExM53MrhKM?=
 =?us-ascii?Q?tJ8RrBrXKRP5XQAITeu/t2AjHTQaFvZk4bnYzy9lzgzfHLRgJqlUocPfQRLk?=
 =?us-ascii?Q?vpDO3LQe3sb/nCAG/Wc/jRvMoDIo5iKdtd9NINDNIh31SMEZZ0RbD5FaRI9D?=
 =?us-ascii?Q?BU/7gIV4aiBf0rIGMYc2Zf8=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: e2770a70-9efa-4269-4c49-08d99f96f632
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2021 13:28:17.5561
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: f9AkR7VoQeoHLD7M+6UnYcYGzY4gQdsu4bQLfuZnhC5uTMcLaqvdSjtNEuIOU20Jl3cIYWjDe7SfRpXVAiA/nQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYBP286MB0334
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Pointer alg points to sub field of tmpl, it
is dereferenced after tmpl is freed. Fix
this by accessing alg before free tmpl.

Fixes: 9363efb4 ("crypto: qce - Add support for AEAD algorithms")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/crypto/qce/aead.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/qce/aead.c b/drivers/crypto/qce/aead.c
index 290e2446a2f3..97a530171f07 100644
--- a/drivers/crypto/qce/aead.c
+++ b/drivers/crypto/qce/aead.c
@@ -802,8 +802,8 @@ static int qce_aead_register_one(const struct qce_aead_def *def, struct qce_devi
 
 	ret = crypto_register_aead(alg);
 	if (ret) {
-		kfree(tmpl);
 		dev_err(qce->dev, "%s registration failed\n", alg->base.cra_name);
+		kfree(tmpl);
 		return ret;
 	}
 
-- 
2.17.1