Commit 889b0e27 authored by Alper Ak's avatar Alper Ak Committed by Herbert Xu
Browse files

crypto: ccp - Fix use-after-free on error path 



In the error path of sev_tsm_init_locked(), the code dereferences 't'
after it has been freed with kfree(). The pr_err() statement attempts
to access t->tio_en and t->tio_init_done after the memory has been
released.

Move the pr_err() call before kfree(t) to access the fields while the
memory is still valid.

This issue reported by Smatch static analyser

Fixes:4be42357 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)")
Signed-off-by: default avatarAlper Ak <alperyasinak1@gmail.com>
Acked-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 8168a7b7

drivers/crypto/ccp/sev-dev-tsm.c

+1 −1
Original line number Diff line number Diff line
@@ -378,9 +378,9 @@ void sev_tsm_init_locked(struct sev_device *sev, void *tio_status_page) 
	return;



error_exit:

	kfree(t);

	pr_err("Failed to enable SEV-TIO: ret=%d en=%d initdone=%d SEV=%d\n",

	       ret, t->tio_en, t->tio_init_done, boot_cpu_has(X86_FEATURE_SEV));

	kfree(t);

}



void sev_tsm_uninit(struct sev_device *sev)