On Fri, 23 Oct 2026 16:19:08 +0800, Baokun Li wrote:
> Sashiko reported a possible NULL pointer dereference, triggered by the
> following flow:
>
> dm-inlinecrypt ctor # first use of the fallback
> ├─ blk_crypto_init_key() # succeeds, ctx->key.size != 0
> ├─ blk_crypto_start_using_key()
> │ ├─ hw-wrapped key: -EOPNOTSUPP
> │ │ # profile never allocated (NULL)
> │ └─ raw key: fallback_start_using_mode()
> │ └─ blk_crypto_fallback_init() fails
> │ └─ kfree(profile) # not NULLed
> ├─ goto bad
> └─ inlinecrypt_dtr() # evicts whenever key.size is set
> └─ blk_crypto_evict_key()
> └─ blk_crypto_config_supported_natively() = false
> └─ blk_crypto_fallback_evict_key()
> └─ __blk_crypto_evict_key(blk_crypto_fallback_profile)
> └─ profile->num_slots # BOOM!!!
>
> [...]
Applied, thanks!
[1/1] blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
commit: c8c53d669d4e45b3a804013251a34387d7e11bfb
Best regards,
--
Jens Axboe
