Re: [PATCH] crypto: keembay - fix list_first_entry() on empty dev_list in find_dev helpers

[Herbert Xu]

On Mon, Oct 26, 2026 at 07:56:46PM +0800, Li Ximo wrote:
> From: Wang Haoran <haoranwangsec@xxxxxxxxx>
> 
> list_first_entry() does not return NULL on an empty list; it returns a
> bogus pointer computed by container_of() from the list head. Both
> kmb_ocs_aes_find_dev() and kmb_ocs_ecc_find_dev() call list_first_entry()
> on their global dev_list without checking list_empty() first. The list
> becomes empty after the single OCS device is removed (kmb_ocs_aes_remove()
> / kmb_ocs_ecc_remove() do list_del()), while existing tfm instances may
> still invoke find_dev afterwards: for AES the device lookup is deferred
> until the first encrypt/decrypt operation (setkey only stores the key),
> and for ECC init_tfm of a new tfm can run after the device was unbound.
> In both cases the bogus pointer passes the callers' validity checks
> (the AES callers test for NULL, the ECC caller tests with IS_ERR(); a
> container_of() address inside a static struct satisfies neither) and is
> later dereferenced via ->engine or used for MMIO through ->base_reg,
> causing memory corruption or a kernel crash. This was found by code
> audit; we do not have Keem Bay hardware to reproduce it.
> 
> Fix both helpers to use list_first_entry_or_null(). The AES helper now
> returns NULL on an empty list, matching the existing NULL checks in its
> callers. The ECC helper converts NULL to ERR_PTR(-ENODEV), matching the
> existing IS_ERR() check in kmb_ecc_tctx_init().
> 
> Reported-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> Reported-by: Li Ximo <lixicaicai@xxxxxxxxx>
> Signed-off-by: Wang Haoran <haoranwangsec@xxxxxxxxx>
> ---
>  drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 3 ++-
>  drivers/crypto/intel/keembay/keembay-ocs-ecc.c      | 7 +++++--
>  2 files changed, 7 insertions(+), 3 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt