Commit 31bd44e7 authored Aug 25, 2016 by Herbert Xu

crypto: cryptd - Use correct tfm object for AEAD tracking



The AEAD code path incorrectly uses the child tfm to track the
cryptd refcnt, and then potentially frees the child tfm.

Fixes: 81760ea6 ("crypto: cryptd - Add helpers to check...")
Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent 901d3d4f

crypto/cryptd.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
		rctx = aead_request_ctx(req);
		compl = rctx->complete;

		tfm = crypto_aead_reqtfm(req);

		if (unlikely(err == -EINPROGRESS))
		goto out;
		aead_request_set_tfm(req, child);
		err = crypt( req );

		out:
		tfm = crypto_aead_reqtfm(req);
		ctx = crypto_aead_ctx(tfm);
		refcnt = atomic_read(&ctx->refcnt);