[PATCH] crypto: ixp4xx - Free the fallback cipher if context initialization fails

[PATCH] crypto: ixp4xx - Free the fallback cipher if context initialization fails

[Wentao Liang]

init_tfm_ablk() allocates a fallback skcipher before calling init_tfm().
If allocating either security association context fails, init_tfm()
returns an error and the fallback is left allocated. The crypto core
does not call the algorithm exit callback after a failed initialization,
so exit_tfm_ablk() cannot release it.

Free the fallback cipher when init_tfm() fails. The security association
contexts are already unwound by init_tfm().

Fixes: dfb098d692ea ("crypto: ixp4xx - fallback when having more than one SG")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
index 33e8e887a415..6af50a01c96f 100644
--- a/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
+++ b/drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c
@@ -635,6 +635,7 @@ static int init_tfm_ablk(struct crypto_skcipher *tfm)
 	struct crypto_tfm *ctfm = crypto_skcipher_tfm(tfm);
 	struct ixp_ctx *ctx = crypto_tfm_ctx(ctfm);
 	const char *name = crypto_tfm_alg_name(ctfm);
+	int ret;
 
 	ctx->fallback_tfm = crypto_alloc_skcipher(name, 0, CRYPTO_ALG_NEED_FALLBACK);
 	if (IS_ERR(ctx->fallback_tfm)) {
@@ -649,7 +650,11 @@ static int init_tfm_ablk(struct crypto_skcipher *tfm)
 		 );
 
 	crypto_skcipher_set_reqsize(tfm, sizeof(struct ablk_ctx) + crypto_skcipher_reqsize(ctx->fallback_tfm));
-	return init_tfm(crypto_skcipher_tfm(tfm));
+	ret = init_tfm(crypto_skcipher_tfm(tfm));
+	if (ret)
+		crypto_free_skcipher(ctx->fallback_tfm);
+
+	return ret;
 }
 
 static int init_tfm_aead(struct crypto_aead *tfm)
-- 
2.34.1

Re: [PATCH] crypto: ixp4xx - Free the fallback cipher if context initialization fails

[Krzysztof Kozlowski]

On 03/11/2026 07:29, Wentao Liang wrote:
> init_tfm_ablk() allocates a fallback skcipher before calling init_tfm().
> If allocating either security association context fails, init_tfm()
> returns an error and the fallback is left allocated. The crypto core
> does not call the algorithm exit callback after a failed initialization,
> so exit_tfm_ablk() cannot release it.
> 
> Free the fallback cipher when init_tfm() fails. The security association
> contexts are already unwound by init_tfm().
> 
> Fixes: dfb098d692ea ("crypto: ixp4xx - fallback when having more than one SG")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Another fake identity of "vulab" doing exactly the same as other cases,
repeating same mistake of running unsupervised crappy bot even though
was asked multiple times to fix that.

Best regards,
Krzysztof