summaryrefslogtreecommitdiffstats
path: root/crypto/pcbc.c
diff options
context:
space:
mode:
authorPan Bian <bianpan2016@163.com>2018-11-22 11:00:16 +0100
committerHerbert Xu <herbert@gondor.apana.org.au>2018-11-29 07:53:59 +0100
commite5bde04ccce64d808f8b00a489a1fe5825d285cb (patch)
treeff071a695559c7343c9ca04744794332368e0ecd /crypto/pcbc.c
parentcrypto: user - Zeroize whole structure given to user space (diff)
downloadlinux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.tar.xz
linux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.zip
crypto: do not free algorithm before using
In multiple functions, the algorithm fields are read after its reference is dropped through crypto_mod_put. In this case, the algorithm memory may be freed, resulting in use-after-free bugs. This patch delays the put operation until the algorithm is never used. Fixes: 79c65d179a40 ("crypto: cbc - Convert to skcipher") Fixes: a7d85e06ed80 ("crypto: cfb - add support for Cipher FeedBack mode") Fixes: 043a44001b9e ("crypto: pcbc - Convert to skcipher") Cc: <stable@vger.kernel.org> Signed-off-by: Pan Bian <bianpan2016@163.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/pcbc.c')
-rw-r--r--crypto/pcbc.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/pcbc.c b/crypto/pcbc.c
index ef802f6e9642..8aa10144407c 100644
--- a/crypto/pcbc.c
+++ b/crypto/pcbc.c
@@ -244,9 +244,8 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
spawn = skcipher_instance_ctx(inst);
err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
CRYPTO_ALG_TYPE_MASK);
- crypto_mod_put(alg);
if (err)
- goto err_free_inst;
+ goto err_put_alg;
err = crypto_inst_setname(skcipher_crypto_instance(inst), "pcbc", alg);
if (err)
@@ -275,12 +274,15 @@ static int crypto_pcbc_create(struct crypto_template *tmpl, struct rtattr **tb)
err = skcipher_register_instance(tmpl, inst);
if (err)
goto err_drop_spawn;
+ crypto_mod_put(alg);
out:
return err;
err_drop_spawn:
crypto_drop_spawn(spawn);
+err_put_alg:
+ crypto_mod_put(alg);
err_free_inst:
kfree(inst);
goto out;