From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Wed, 24 Jul 2019 09:43:06 +0000 (+0800)
Subject: libceph: don't call crypto_free_sync_skcipher() on a NULL tfm
X-Git-Tag: v5.4-rc1~264^2~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e8c99200b4d117c340c392ebd5e62d85dfeed027;p=platform%2Fkernel%2Flinux-rpi.git

libceph: don't call crypto_free_sync_skcipher() on a NULL tfm

In set_secret(), key->tfm is assigned to NULL on line 55, and then
ceph_crypto_key_destroy(key) is executed.

ceph_crypto_key_destroy(key)
  crypto_free_sync_skcipher(key->tfm)
    crypto_free_skcipher(&tfm->base);

This happens to work because crypto_sync_skcipher is a trivial wrapper
around crypto_skcipher: &tfm->base is still 0 and crypto_free_skcipher()
handles that.  Let's not rely on the layout of crypto_sync_skcipher.

This bug is found by a static analysis tool STCheck written by us.

Fixes: 69d6302b65a8 ("libceph: Remove VLA usage of skcipher").
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---

diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 5d6724c..4f75df4 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -136,8 +136,10 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
 	if (key) {
 		kfree(key->key);
 		key->key = NULL;
-		crypto_free_sync_skcipher(key->tfm);
-		key->tfm = NULL;
+		if (key->tfm) {
+			crypto_free_sync_skcipher(key->tfm);
+			key->tfm = NULL;
+		}
 	}
 }