If a->d is NULL, the NULL pointer will be dereferenced. It is necessary to prevent this case. There is at least one call stack that can lead to it: mpi_ec_curve_point() ec_pow2() ec_mulm() ec_mod() mpi_mod() mpi_fdiv_r() mpi_tdiv_r() mpi_tdiv_qr() mpi_resize() kcalloc() mpi_resize can return -ENOMEM, but this case is not handled in any way. Next, dereferencing takes place: mpi_ec_curve_point() mpi_cmp() do_mpi_cmp() mpi_normalize() Found by Linux Verification Center (linuxtesting.org) with Svace. Signed-off-by: Roman Smirnov <r.smirnov@xxxxxx> --- lib/crypto/mpi/mpi-bit.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/crypto/mpi/mpi-bit.c b/lib/crypto/mpi/mpi-bit.c index 070ba784c9f1..d7420bdb4ff2 100644 --- a/lib/crypto/mpi/mpi-bit.c +++ b/lib/crypto/mpi/mpi-bit.c @@ -29,6 +29,9 @@ */ void mpi_normalize(MPI a) { + if (!a || !a->d) + return; + for (; a->nlimbs && !a->d[a->nlimbs - 1]; a->nlimbs--) ; } -- 2.34.1