diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2016-08-25 10:49:51 +0200 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2016-08-31 16:50:40 +0200 |
| commit | 31bd44e7687be8a70e1e744e5cb84974b798d568 (patch) | |
| tree | 09a8c2ddfcbd400a1a24772714c047347a1ed899 /crypto/cryptd.c | |
| parent | crypto: vmx - fix null dereference in p8_aes_xts_crypt (diff) | |
| download | linux-31bd44e7687be8a70e1e744e5cb84974b798d568.tar.xz linux-31bd44e7687be8a70e1e744e5cb84974b798d568.zip | |
crypto: cryptd - Use correct tfm object for AEAD tracking
The AEAD code path incorrectly uses the child tfm to track the
cryptd refcnt, and then potentially frees the child tfm.
Fixes: 81760ea6a95a ("crypto: cryptd - Add helpers to check...")
Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/cryptd.c')
| -rw-r--r-- | crypto/cryptd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/crypto/cryptd.c b/crypto/cryptd.c index cf8037a87b2d..77207b41940c 100644 --- a/crypto/cryptd.c +++ b/crypto/cryptd.c @@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req, rctx = aead_request_ctx(req); compl = rctx->complete; + tfm = crypto_aead_reqtfm(req); + if (unlikely(err == -EINPROGRESS)) goto out; aead_request_set_tfm(req, child); err = crypt( req ); out: - tfm = crypto_aead_reqtfm(req); ctx = crypto_aead_ctx(tfm); refcnt = atomic_read(&ctx->refcnt); |