diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-01-20 17:38:04 +0300 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2020-02-13 16:58:09 +0800 |
| commit | eed74b3eba9eda36d155c11a12b2b4b50c67c1d8 (patch) | |
| tree | 14b7a161d17ae097c8722fe498ee1fe588861b00 | |
| parent | 00e62e868ccd230e92c6f08ef2877ede10292882 (diff) | |
| download | linux-stable-eed74b3eba9eda36d155c11a12b2b4b50c67c1d8.tar.gz linux-stable-eed74b3eba9eda36d155c11a12b2b4b50c67c1d8.tar.bz2 linux-stable-eed74b3eba9eda36d155c11a12b2b4b50c67c1d8.zip | |
crypto: rng - Fix a refcounting bug in crypto_rng_reset()
We need to decrement this refcounter on these error paths.
Fixes: f7d76e05d058 ("crypto: user - fix use_after_free of struct xxx_request")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | crypto/rng.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/crypto/rng.c b/crypto/rng.c index 1e21231f71c9..1490d210f1a1 100644 --- a/crypto/rng.c +++ b/crypto/rng.c @@ -37,12 +37,16 @@ int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen) crypto_stats_get(alg); if (!seed && slen) { buf = kmalloc(slen, GFP_KERNEL); - if (!buf) + if (!buf) { + crypto_alg_put(alg); return -ENOMEM; + } err = get_random_bytes_wait(buf, slen); - if (err) + if (err) { + crypto_alg_put(alg); goto out; + } seed = buf; } |