Skip to content

Commit 7966cf0

Browse files
Malaya Kumar Routrafaeljw
authored andcommitted
PM: hibernate: Fix crash when freeing invalid crypto compressor
When crypto_alloc_acomp() fails, it returns an ERR_PTR value, not NULL. The cleanup code in save_compressed_image() and load_compressed_image() unconditionally calls crypto_free_acomp() without checking for ERR_PTR, which causes crypto_acomp_tfm() to dereference an invalid pointer and crash the kernel. This can be triggered when the compression algorithm is unavailable (e.g., CONFIG_CRYPTO_LZO not enabled). Fix by adding IS_ERR_OR_NULL() checks before calling crypto_free_acomp() and acomp_request_free(), similar to the existing kthread_stop() check. Fixes: b03d542 ("PM: hibernate: Use crypto_acomp interface") Signed-off-by: Malaya Kumar Rout <mrout@redhat.com> Cc: 6.15+ <stable@vger.kernel.org> # 6.15+ [ rjw: Added 2 empty code lines ] Link: https://patch.msgid.link/20251230115613.64080-1-mrout@redhat.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
1 parent 9ace475 commit 7966cf0

1 file changed

Lines changed: 10 additions & 4 deletions

File tree

kernel/power/swap.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -902,8 +902,11 @@ static int save_compressed_image(struct swap_map_handle *handle,
902902
for (thr = 0; thr < nr_threads; thr++) {
903903
if (data[thr].thr)
904904
kthread_stop(data[thr].thr);
905-
acomp_request_free(data[thr].cr);
906-
crypto_free_acomp(data[thr].cc);
905+
if (data[thr].cr)
906+
acomp_request_free(data[thr].cr);
907+
908+
if (!IS_ERR_OR_NULL(data[thr].cc))
909+
crypto_free_acomp(data[thr].cc);
907910
}
908911
vfree(data);
909912
}
@@ -1499,8 +1502,11 @@ static int load_compressed_image(struct swap_map_handle *handle,
14991502
for (thr = 0; thr < nr_threads; thr++) {
15001503
if (data[thr].thr)
15011504
kthread_stop(data[thr].thr);
1502-
acomp_request_free(data[thr].cr);
1503-
crypto_free_acomp(data[thr].cc);
1505+
if (data[thr].cr)
1506+
acomp_request_free(data[thr].cr);
1507+
1508+
if (!IS_ERR_OR_NULL(data[thr].cc))
1509+
crypto_free_acomp(data[thr].cc);
15041510
}
15051511
vfree(data);
15061512
}

0 commit comments

Comments
 (0)