Re: [PATCH] crypto/ccp: Fix use-after-free on error path

[Herbert Xu]

On Mon, Feb 09, 2026 at 01:30:42PM +0300, Alper Ak wrote:
> In the error path of sev_tsm_init_locked(), the code dereferences 't'
> after it has been freed with kfree(). The pr_err() statement attempts
> to access t->tio_en and t->tio_init_done after the memory has been
> released.
> 
> Move the pr_err() call before kfree(t) to access the fields while the
> memory is still valid.
> 
> This issue reported by Smatch static analyser
> 
> Fixes:4be423572da1 ("crypto/ccp: Implement SEV-TIO PCIe IDE (phase1)")
> Signed-off-by: Alper Ak <alperyasinak1@xxxxxxxxx>
> ---
>  drivers/crypto/ccp/sev-dev-tsm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt