[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-7.2.3 45/45] virtio-crypto: fix NULL pointer dereference in virt
From: |
Michael Tokarev |
Subject: |
[Stable-7.2.3 45/45] virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_request |
Date: |
Tue, 23 May 2023 13:17:22 +0300 |
From: Mauro Matteo Cascella <mcascell@redhat.com>
Ensure op_info is not NULL in case of QCRYPTODEV_BACKEND_ALG_SYM algtype.
Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm")
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reported-by: Yiming Tao <taoym@zju.edu.cn>
Message-Id: <20230509075317.1132301-1-mcascell@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: zhenwei pi<pizhenwei@bytedance.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 3e69908907f8d3dd20d5753b0777a6e3824ba824)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(Mjt: context tweak after 999c789f00 cryptodev: Introduce cryptodev alg type in
QAPI)
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 97da74e719..a6dbdd32da 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -476,15 +476,17 @@ static void virtio_crypto_free_request(VirtIOCryptoReq
*req)
size_t max_len;
CryptoDevBackendSymOpInfo *op_info = req->op_info.u.sym_op_info;
- max_len = op_info->iv_len +
- op_info->aad_len +
- op_info->src_len +
- op_info->dst_len +
- op_info->digest_result_len;
-
- /* Zeroize and free request data structure */
- memset(op_info, 0, sizeof(*op_info) + max_len);
- g_free(op_info);
+ if (op_info) {
+ max_len = op_info->iv_len +
+ op_info->aad_len +
+ op_info->src_len +
+ op_info->dst_len +
+ op_info->digest_result_len;
+
+ /* Zeroize and free request data structure */
+ memset(op_info, 0, sizeof(*op_info) + max_len);
+ g_free(op_info);
+ }
} else if (req->flags == CRYPTODEV_BACKEND_ALG_ASYM) {
CryptoDevBackendAsymOpInfo *op_info = req->op_info.u.asym_op_info;
if (op_info) {
--
2.39.2
- [Stable-7.2.3 36/45] migration: Handle block device inactivation failures better, (continued)
- [Stable-7.2.3 36/45] migration: Handle block device inactivation failures better, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 37/45] migration: Minor control flow simplification, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 38/45] migration: Attempt disk reactivation in more failure scenarios, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 35/45] linux-user: fix getgroups/setgroups allocations, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 40/45] scsi-generic: fix buffer overflow on block limits inquiry, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 39/45] target/arm: Fix vd == vm overlap in sve_ldff1_z, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 41/45] target/i386: fix operand size for VCOMI/VUCOMI instructions, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 42/45] target/i386: fix avx2 instructions vzeroall and vpermdq, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 44/45] virtio-net: not enable vq reset feature unconditionally, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 43/45] vhost: fix possible wrap in SVQ descriptor ring, Michael Tokarev, 2023/05/23
- [Stable-7.2.3 45/45] virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_request,
Michael Tokarev <=