target/iscsi: avoid NULL dereference in CHAP auth error path
"Linux Kernel Mailing List" <[email protected]>
| Newsgroups | gmane.linux.kernel.commits.head |
|---|---|
| Message-ID | <[email protected]> |
Web: https://git.kernel.org/torvalds/c/ce512d79d0466a604793addb6b769d12ee326822 Commit: ce512d79d0466a604793addb6b769d12ee326822 Parent: 093ec1430f41063d65dfc68d7eddec9d80f8efbb Refname: refs/heads/master Author: David Disseldorp <[email protected]> AuthorDate: Wed Dec 13 18:22:30 2017 +0100 Committer: Nicholas Bellinger <[email protected]> CommitDate: Fri Jan 12 15:07:27 2018 -0800 target/iscsi: avoid NULL dereference in CHAP auth error path If chap_server_compute_md5() fails early, e.g. via CHAP_N mismatch, then crypto_free_shash() is called with a NULL pointer which gets dereferenced in crypto_shash_tfm(). Fixes: 69110e3cedbb ("iscsi-target: Use shash and ahash") Suggested-by: Markus Elfring <[email protected]> Signed-off-by: David Disseldorp <[email protected]> Cc: [email protected] # 4.6+ Signed-off-by: Nicholas Bellinger <[email protected]> --- drivers/target/iscsi/iscsi_target_auth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c index f9bc8ec6fb6b..9518ffd8b8ba 100644 --- a/drivers/target/iscsi/iscsi_target_auth.c +++ b/drivers/target/iscsi/iscsi_target_auth.c @@ -421,7 +421,8 @@ static int chap_server_compute_md5( auth_ret = 0; out: kzfree(desc); - crypto_free_shash(tfm); + if (tfm) + crypto_free_shash(tfm); kfree(challenge); kfree(challenge_binhex); return auth_ret; -- To unsubscribe from this list: send the line "unsubscribe git-commits-head" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html