]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
crypto: ccp - Fix use-after-free on error path
authorAlper Ak <alperyasinak1@gmail.com>
Mon, 9 Feb 2026 10:30:42 +0000 (13:30 +0300)
committerHerbert Xu <herbert@gondor.apana.org.au>
Sat, 28 Feb 2026 03:51:58 +0000 (12:51 +0900)
commit889b0e2721e793eb46cf7d17b965aa3252af3ec8
tree1523c2fb2ddb5632723a3f426d3b15ae5fa09bb2
parent8168a7b72bdee3790b126f63bd30306759206b15
crypto: ccp - Fix use-after-free on error path

In the error path of sev_tsm_init_locked(), the code dereferences 't'
after it has been freed with kfree(). The pr_err() statement attempts
to access t->tio_en and t->tio_init_done after the memory has been
released.

Move the pr_err() call before kfree(t) to access the fields while the
memory is still valid.

This issue reported by Smatch static analyser

Fixes:4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)")
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
drivers/crypto/ccp/sev-dev-tsm.c