Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4702bbee authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: lrw - Fix use-after-free on EINPROGRESS 



When we get an EINPROGRESS completion in lrw, we will end up marking
the request as done and freeing it.  This then blows up when the
request is really completed as we've already freed the memory.

Fixes: 700cb3f5 ("crypto: lrw - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent aa4a829b

crypto/lrw.c

+16 −0
Original line number Diff line number Diff line
@@ -345,6 +345,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err) 
	struct rctx *rctx;



	rctx = skcipher_request_ctx(req);



	if (err == -EINPROGRESS) {

		if (rctx->left != req->cryptlen)

			return;

		goto out;

	}



	subreq = &rctx->subreq;

	subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
@@ -352,6 +359,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err) 
	if (rctx->left)

		return;



out:

	skcipher_request_complete(req, err);

}
@@ -389,6 +397,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err) 
	struct rctx *rctx;



	rctx = skcipher_request_ctx(req);



	if (err == -EINPROGRESS) {

		if (rctx->left != req->cryptlen)

			return;

		goto out;

	}



	subreq = &rctx->subreq;

	subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
@@ -396,6 +411,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err) 
	if (rctx->left)

		return;



out:

	skcipher_request_complete(req, err);

}