Re: [PATCH 1/2] ceph: avoid NULL pointer dereference in ceph_crypto_key_destroy()

[Chengguang Xu <cgxu519@xxxxxxxxxx>]

Thanks,
Chengguang.



> 在 2018年2月5日，下午7:51，Ilya Dryomov <idryomov@xxxxxxxxx> 写道：
> 
> On Sun, Feb 4, 2018 at 11:08 AM, Chengguang Xu <cgxu519@xxxxxxxxxx> wrote:
>> There are many reasons of failure from get_secret(),
>> so it's necessary to add a check before calling crypto_free_skcipher()
>> in case of NULL pointer dereference.
>> 
>> Signed-off-by: Chengguang Xu <cgxu519@xxxxxxxxxx>
>> ---
>> net/ceph/crypto.c | 6 ++++--
>> 1 file changed, 4 insertions(+), 2 deletions(-)
>> 
>> diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
>> index bf9d079..bb1dc2d 100644
>> --- a/net/ceph/crypto.c
>> +++ b/net/ceph/crypto.c
>> @@ -136,8 +136,10 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
>>        if (key) {
>>                kfree(key->key);
>>                key->key = NULL;
>> -               crypto_free_skcipher(key->tfm);
>> -               key->tfm = NULL;
>> +               if (key->tfm) {
>> +                       crypto_free_skcipher(key->tfm);
>> +                       key->tfm = NULL;
>> +               }
>>        }
>> }
> 
> Hi Chengguang,
> 
> crypto_free_skcipher() can handle a NULL pointer just fine:
> 
>    void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm)
>    {
>            struct crypto_alg *alg;
> 
>            if (unlikely(!mem))
>                    return;

Hi Ilya,

How about crypto_skcipher_tfm() in below call stack?

ceph_crypto_key_destroy() -> crypto_free_skcipher() -> crypto_destroy_tfm() -> crypto_skcipher_tfm()
                                                                               
static inline struct crypto_tfm *crypto_skcipher_tfm(
	struct crypto_skcipher *tfm)
{
	return &tfm->base;
}





--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html