| commit | aa4a829bdaced81e70c215a84ef6595ce8bd4308 | |
| author | Herbert Xu <herbert@gondor.apana.org.au> | |
| Sat, 8 Apr 2017 02:02:46 +0000 (8 10:02 +0800) | ||
| committer | Herbert Xu <herbert@gondor.apana.org.au> | |
| Mon, 10 Apr 2017 11:09:17 +0000 (10 19:09 +0800) | ||
| tree | bd43c4cb8887df86b71b5be81bcdd4d555188ea1 | treesnapshot (tar.gz zip) |
| parent | 40c98cb57cdbc377456116ad4582c89e329721b0 | commitdiff |
crypto: xts - Fix use-after-free on EINPROGRESS
When we get an EINPROGRESS completion in xts, we will end up marking
the request as done and freeing it. This then blows up when the
request is really completed as we've already freed the memory.
Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Reported-by: Nathan Royce <nroycea+kernel@gmail.com>
Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
When we get an EINPROGRESS completion in xts, we will end up marking
the request as done and freeing it. This then blows up when the
request is really completed as we've already freed the memory.
Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Reported-by: Nathan Royce <nroycea+kernel@gmail.com>
Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
| crypto/xts.c | diffblobblamehistory |