Re: [PATCH] crypto/ccp: Fix use-after-free on error path

[Tom Lendacky]

On 2/9/26 04:30, Alper Ak wrote:
> In the error path of sev_tsm_init_locked(), the code dereferences 't'
> after it has been freed with kfree(). The pr_err() statement attempts
> to access t->tio_en and t->tio_init_done after the memory has been
> released.
> 
> Move the pr_err() call before kfree(t) to access the fields while the
> memory is still valid.
> 
> This issue reported by Smatch static analyser
> 
> Fixes:4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)")
> Signed-off-by: Alper Ak <alperyasinak1@xxxxxxxxx>

Acked-by: Tom Lendacky <thomas.lendacky@xxxxxxx>

> ---
>  drivers/crypto/ccp/sev-dev-tsm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/crypto/ccp/sev-dev-tsm.c b/drivers/crypto/ccp/sev-dev-tsm.c
> index 3cdc38e84500..e0d2e3dd063d 100644
> --- a/drivers/crypto/ccp/sev-dev-tsm.c
> +++ b/drivers/crypto/ccp/sev-dev-tsm.c
> @@ -378,9 +378,9 @@ void sev_tsm_init_locked(struct sev_device *sev, void *tio_status_page)
>  	return;
>  
>  error_exit:
> -	kfree(t);
>  	pr_err("Failed to enable SEV-TIO: ret=%d en=%d initdone=%d SEV=%d\n",
>  	       ret, t->tio_en, t->tio_init_done, boot_cpu_has(X86_FEATURE_SEV));
> +	kfree(t);
>  }
>  
>  void sev_tsm_uninit(struct sev_device *sev)