queue-4.19/pstore-set-tfm-to-null-on-free_buf_for_compression.patch

   1 From a9fb94a99bb515d8720ba8440ce3aba84aec80f8 Mon Sep 17 00:00:00 2001
   2 From: Pi-Hsun Shih <pihsun@chromium.org>
   3 Date: Mon, 20 May 2019 14:51:19 +0800
   4 Subject: pstore: Set tfm to NULL on free_buf_for_compression
   5
   6 From: Pi-Hsun Shih <pihsun@chromium.org>
   7
   8 commit a9fb94a99bb515d8720ba8440ce3aba84aec80f8 upstream.
   9
  10 Set tfm to NULL on free_buf_for_compression() after crypto_free_comp().
  11
  12 This avoid a use-after-free when allocate_buf_for_compression()
  13 and free_buf_for_compression() are called twice. Although
  14 free_buf_for_compression() freed the tfm, allocate_buf_for_compression()
  15 won't reinitialize the tfm since the tfm pointer is not NULL.
  16
  17 Fixes: 95047b0519c1 ("pstore: Refactor compression initialization")
  18 Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
  19 Cc: stable@vger.kernel.org
  20 Signed-off-by: Kees Cook <keescook@chromium.org>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  fs/pstore/platform.c |    4 +++-
  25  1 file changed, 3 insertions(+), 1 deletion(-)
  26
  27 --- a/fs/pstore/platform.c
  28 +++ b/fs/pstore/platform.c
  29 @@ -324,8 +324,10 @@ static void allocate_buf_for_compression
  30
  31  static void free_buf_for_compression(void)
  32  {
  33 -       if (IS_ENABLED(CONFIG_PSTORE_COMPRESS) && tfm)
  34 +       if (IS_ENABLED(CONFIG_PSTORE_COMPRESS) && tfm) {
  35                 crypto_free_comp(tfm);
  36 +               tfm = NULL;
  37 +       }
  38         kfree(big_oops_buf);
  39         big_oops_buf = NULL;
  40         big_oops_buf_sz = 0;