[PATCH] crypto: omap-aes - fix NULL pointer dereference in omap_aes_remove()

[ZhaoJinming]

omap_aes_remove() unconditionally dereferences dd->pdata->aead_algs_info,
but only omap_aes_pdata_omap4 initializes that field:

	static const struct omap_aes_pdata omap_aes_pdata_omap2 = {
		.algs_info	= omap_aes_algs_info_ecb_cbc,
		...
	};

	static const struct omap_aes_pdata omap_aes_pdata_omap3 = {
		.algs_info	= omap_aes_algs_info_ecb_cbc_ctr,
		...
	};

	static const struct omap_aes_pdata omap_aes_pdata_omap4 = {
		...
		.aead_algs_info	= &omap_aes_aead_info,
		...
	};

For omap2 and omap3 the field stays NULL, so on those SoCs unbinding
the bound device (e.g. via sysfs unbind) or unloading the module (rmmod)
dereferences a NULL pointer:

	crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
				       dd->pdata->aead_algs_info->registered);
	dd->pdata->aead_algs_info->registered = 0;

This is a hard crash, reachable from the teardown path only; probe
errors do not get here.  The asymmetry dates back to the commit that
introduced GCM support, which guarded the registration of the AEAD
algorithms but not their unregistration.  The registration path in
omap_aes_probe() already guards the same access with
"if (dd->pdata->aead_algs_info && ...)", so add the matching check to
the remove path.

Fixes: ad18cc9d0f91 ("crypto: omap-aes - Add support for GCM mode")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>
---
 drivers/crypto/omap-aes.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index d40074e5a142..8a932451ccf9 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1199,9 +1199,11 @@ static void omap_aes_remove(struct platform_device *pdev)
 
 	omap_aes_unregister_algs(dd->pdata);
 
-	crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
-				       dd->pdata->aead_algs_info->registered);
-	dd->pdata->aead_algs_info->registered = 0;
+	if (dd->pdata->aead_algs_info) {
+		crypto_engine_unregister_aeads(dd->pdata->aead_algs_info->algs_list,
+					       dd->pdata->aead_algs_info->registered);
+		dd->pdata->aead_algs_info->registered = 0;
+	}
 
 	crypto_engine_exit(dd->engine);
 

---
base-commit: 2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e
change-id: 20261016-omap-aes-remove-null-deref-a3444b7bb17d

Best regards,
--  
ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>