[PATCH] crypto: omap-aes - fix NULL pointer dereference in omap_aes_remove()

[PATCH] crypto: omap-aes - fix NULL pointer dereference in omap_aes_remove()

[ZhaoJinming]

omap_aes_remove() unconditionally dereferences dd->pdata->aead_algs_info,
but only omap_aes_pdata_omap4 initializes that field:

	static const struct omap_aes_pdata omap_aes_pdata_omap2 = {
		.algs_info	= omap_aes_algs_info_ecb_cbc,
		...
	};

	static const struct omap_aes_pdata omap_aes_pdata_omap3 = {
		.algs_info	= omap_aes_algs_info_ecb_cbc_ctr,
		...
	};

	static const struct omap_aes_pdata omap_aes_pdata_omap4 = {
		...
		.aead_algs_info	= &omap_aes_aead_info,
		...
	};

For omap2 and omap3 the field stays NULL, so on those SoCs unbinding
the bound device (e.g. via sysfs unbind) or unloading the module (rmmod)
dereferences a NULL pointer:

	crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
				       dd->pdata->aead_algs_info->registered);
	dd->pdata->aead_algs_info->registered = 0;

This is a hard crash, reachable from the teardown path only; probe
errors do not get here.  The asymmetry dates back to the commit that
introduced GCM support, which guarded the registration of the AEAD
algorithms but not their unregistration.  The registration path in
omap_aes_probe() already guards the same access with
"if (dd->pdata->aead_algs_info && ...)", so add the matching check to
the remove path.

Fixes: ad18cc9d0f91 ("crypto: omap-aes - Add support for GCM mode")
Cc: stable@vger.kernel.org
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
---
 drivers/crypto/omap-aes.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index d40074e5a142..8a932451ccf9 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1199,9 +1199,11 @@ static void omap_aes_remove(struct platform_device *pdev)
 
 	omap_aes_unregister_algs(dd->pdata);
 
-	crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
-				       dd->pdata->aead_algs_info->registered);
-	dd->pdata->aead_algs_info->registered = 0;
+	if (dd->pdata->aead_algs_info) {
+		crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
+					       dd->pdata->aead_algs_info->registered);
+		dd->pdata->aead_algs_info->registered = 0;
+	}
 
 	crypto_engine_exit(dd->engine);
 

---
base-commit: 2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e
change-id: 20261016-omap-aes-remove-null-deref-a3444b7bb17d

Best regards,
--  
ZhaoJinming <zhaojinming@uniontech.com>

Re: [PATCH] crypto: omap-aes - fix NULL pointer dereference in omap_aes_remove()

[Herbert Xu]

On Fri, Oct 16, 2026 at 04:30:04PM +0800, ZhaoJinming wrote:
> omap_aes_remove() unconditionally dereferences dd->pdata->aead_algs_info,
> but only omap_aes_pdata_omap4 initializes that field:
> 
> 	static const struct omap_aes_pdata omap_aes_pdata_omap2 = {
> 		.algs_info	= omap_aes_algs_info_ecb_cbc,
> 		...
> 	};
> 
> 	static const struct omap_aes_pdata omap_aes_pdata_omap3 = {
> 		.algs_info	= omap_aes_algs_info_ecb_cbc_ctr,
> 		...
> 	};
> 
> 	static const struct omap_aes_pdata omap_aes_pdata_omap4 = {
> 		...
> 		.aead_algs_info	= &omap_aes_aead_info,
> 		...
> 	};
> 
> For omap2 and omap3 the field stays NULL, so on those SoCs unbinding
> the bound device (e.g. via sysfs unbind) or unloading the module (rmmod)
> dereferences a NULL pointer:
> 
> 	crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
> 				       dd->pdata->aead_algs_info->registered);
> 	dd->pdata->aead_algs_info->registered = 0;
> 
> This is a hard crash, reachable from the teardown path only; probe
> errors do not get here.  The asymmetry dates back to the commit that
> introduced GCM support, which guarded the registration of the AEAD
> algorithms but not their unregistration.  The registration path in
> omap_aes_probe() already guards the same access with
> "if (dd->pdata->aead_algs_info && ...)", so add the matching check to
> the remove path.
> 
> Fixes: ad18cc9d0f91 ("crypto: omap-aes - Add support for GCM mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
> ---
>  drivers/crypto/omap-aes.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt