Skip to content

Commit 889b0e2

Browse files
alperakherbertx
authored andcommitted
crypto: ccp - Fix use-after-free on error path
In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to access t->tio_en and t->tio_init_done after the memory has been released. Move the pr_err() call before kfree(t) to access the fields while the memory is still valid. This issue reported by Smatch static analyser Fixes:4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Acked-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
1 parent 8168a7b commit 889b0e2

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/crypto/ccp/sev-dev-tsm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -378,9 +378,9 @@ void sev_tsm_init_locked(struct sev_device *sev, void *tio_status_page)
378378
return;
379379

380380
error_exit:
381-
kfree(t);
382381
pr_err("Failed to enable SEV-TIO: ret=%d en=%d initdone=%d SEV=%d\n",
383382
ret, t->tio_en, t->tio_init_done, boot_cpu_has(X86_FEATURE_SEV));
383+
kfree(t);
384384
}
385385

386386
void sev_tsm_uninit(struct sev_device *sev)

0 commit comments

Comments
 (0)