[PATCH] crypto: keembay - fix list_first_entry() on empty dev_list in find_dev helpers

[PATCH] crypto: keembay - fix list_first_entry() on empty dev_list in find_dev helpers

[Li Ximo]

From: Wang Haoran <haoranwangsec@gmail.com>

list_first_entry() does not return NULL on an empty list; it returns a
bogus pointer computed by container_of() from the list head. Both
kmb_ocs_aes_find_dev() and kmb_ocs_ecc_find_dev() call list_first_entry()
on their global dev_list without checking list_empty() first. The list
becomes empty after the single OCS device is removed (kmb_ocs_aes_remove()
/ kmb_ocs_ecc_remove() do list_del()), while existing tfm instances may
still invoke find_dev afterwards: for AES the device lookup is deferred
until the first encrypt/decrypt operation (setkey only stores the key),
and for ECC init_tfm of a new tfm can run after the device was unbound.
In both cases the bogus pointer passes the callers' validity checks
(the AES callers test for NULL, the ECC caller tests with IS_ERR(); a
container_of() address inside a static struct satisfies neither) and is
later dereferenced via ->engine or used for MMIO through ->base_reg,
causing memory corruption or a kernel crash. This was found by code
audit; we do not have Keem Bay hardware to reproduce it.

Fix both helpers to use list_first_entry_or_null(). The AES helper now
returns NULL on an empty list, matching the existing NULL checks in its
callers. The ECC helper converts NULL to ERR_PTR(-ENODEV), matching the
existing IS_ERR() check in kmb_ecc_tctx_init().

Reported-by: Wang Haoran <haoranwangsec@gmail.com>
Reported-by: Li Ximo <lixicaicai@gmail.com>
Signed-off-by: Wang Haoran <haoranwangsec@gmail.com>
---
 drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 3 ++-
 drivers/crypto/intel/keembay/keembay-ocs-ecc.c      | 7 +++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
index 660830c36..268a15886 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-aes-core.c
@@ -129,7 +129,8 @@ static struct ocs_aes_dev *kmb_ocs_aes_find_dev(struct ocs_aes_tctx *tctx)
 	}
 
 	/* Only a single OCS device available */
-	aes_dev = list_first_entry(&ocs_aes.dev_list, struct ocs_aes_dev, list);
+	aes_dev = list_first_entry_or_null(&ocs_aes.dev_list,
+					   struct ocs_aes_dev, list);
 	tctx->aes_dev = aes_dev;
 
 exit:
diff --git a/drivers/crypto/intel/keembay/keembay-ocs-ecc.c b/drivers/crypto/intel/keembay/keembay-ocs-ecc.c
index 9bdee39dc..67a69a205 100644
--- a/drivers/crypto/intel/keembay/keembay-ocs-ecc.c
+++ b/drivers/crypto/intel/keembay/keembay-ocs-ecc.c
@@ -208,11 +208,14 @@ static struct ocs_ecc_dev *kmb_ocs_ecc_find_dev(struct ocs_ecc_ctx *tctx)
 	spin_lock(&ocs_ecc.lock);
 
 	/* Only a single OCS device available. */
-	tctx->ecc_dev = list_first_entry(&ocs_ecc.dev_list, struct ocs_ecc_dev,
-					 list);
+	tctx->ecc_dev = list_first_entry_or_null(&ocs_ecc.dev_list,
+						 struct ocs_ecc_dev, list);
 
 	spin_unlock(&ocs_ecc.lock);
 
+	if (!tctx->ecc_dev)
+		return ERR_PTR(-ENODEV);
+
 	return tctx->ecc_dev;
 }
 
-- 
2.30.2