summaryrefslogtreecommitdiffstats
path: root/crypto/cfb.c
diff options
context:
space:
mode:
authorPan Bian <bianpan2016@163.com>2018-11-22 11:00:16 +0100
committerHerbert Xu <herbert@gondor.apana.org.au>2018-11-29 07:53:59 +0100
commite5bde04ccce64d808f8b00a489a1fe5825d285cb (patch)
treeff071a695559c7343c9ca04744794332368e0ecd /crypto/cfb.c
parentcrypto: user - Zeroize whole structure given to user space (diff)
downloadlinux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.tar.xz
linux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.zip
crypto: do not free algorithm before using
In multiple functions, the algorithm fields are read after its reference is dropped through crypto_mod_put. In this case, the algorithm memory may be freed, resulting in use-after-free bugs. This patch delays the put operation until the algorithm is never used. Fixes: 79c65d179a40 ("crypto: cbc - Convert to skcipher") Fixes: a7d85e06ed80 ("crypto: cfb - add support for Cipher FeedBack mode") Fixes: 043a44001b9e ("crypto: pcbc - Convert to skcipher") Cc: <stable@vger.kernel.org> Signed-off-by: Pan Bian <bianpan2016@163.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/cfb.c')
-rw-r--r--crypto/cfb.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/cfb.c b/crypto/cfb.c
index a0d68c09e1b9..20987d0e09d8 100644
--- a/crypto/cfb.c
+++ b/crypto/cfb.c
@@ -286,9 +286,8 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
spawn = skcipher_instance_ctx(inst);
err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
CRYPTO_ALG_TYPE_MASK);
- crypto_mod_put(alg);
if (err)
- goto err_free_inst;
+ goto err_put_alg;
err = crypto_inst_setname(skcipher_crypto_instance(inst), "cfb", alg);
if (err)
@@ -317,12 +316,15 @@ static int crypto_cfb_create(struct crypto_template *tmpl, struct rtattr **tb)
err = skcipher_register_instance(tmpl, inst);
if (err)
goto err_drop_spawn;
+ crypto_mod_put(alg);
out:
return err;
err_drop_spawn:
crypto_drop_spawn(spawn);
+err_put_alg:
+ crypto_mod_put(alg);
err_free_inst:
kfree(inst);
goto out;