Commit 9ae0c92f authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: scomp - Fix wild memory accesses in scomp_free_streams 



In order to use scomp_free_streams to free the partially allocted
streams in the allocation error path, move the alg->stream assignment
to the beginning.  Also check for error pointers in scomp_free_streams
before freeing the ctx.

Finally set alg->stream to NULL to not break subsequent attempts
to allocate the streams.

Fixes: 3d72ad46 ("crypto: acomp - Move stream management into scomp layer")
Reported-by: default avatarsyzkaller <syzkaller@googlegroups.com>
Co-developed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Co-developed-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent b7b39df7

crypto/scompress.c

+4 −3
Original line number Diff line number Diff line
@@ -111,13 +111,14 @@ static void scomp_free_streams(struct scomp_alg *alg) 
	struct crypto_acomp_stream __percpu *stream = alg->stream;

	int i;



	alg->stream = NULL;

	if (!stream)

		return;



	for_each_possible_cpu(i) {

		struct crypto_acomp_stream *ps = per_cpu_ptr(stream, i);



		if (!ps->ctx)

		if (IS_ERR_OR_NULL(ps->ctx))

			break;



		alg->free_ctx(ps->ctx);
@@ -135,6 +136,8 @@ static int scomp_alloc_streams(struct scomp_alg *alg) 
	if (!stream)

		return -ENOMEM;



	alg->stream = stream;



	for_each_possible_cpu(i) {

		struct crypto_acomp_stream *ps = per_cpu_ptr(stream, i);
@@ -146,8 +149,6 @@ static int scomp_alloc_streams(struct scomp_alg *alg) 


		spin_lock_init(&ps->lock);

	}



	alg->stream = stream;

	return 0;

}