summaryrefslogtreecommitdiffstats
path: root/crypto
diff options
context:
space:
mode:
authorSteffen Klassert <steffen.klassert@secunet.com>2010-11-10 12:21:43 +0100
committerLinus Torvalds <torvalds@linux-foundation.org>2010-11-12 07:58:46 -0800
commite2b348354112df63a9c2ea4219a6867c6c7ea100 (patch)
treeb9a0703ac3e356e3df7941a5e6e53dd6e83fefde /crypto
parentbd760e1e5b34351e0705705e5163cb89c1316d71 (diff)
downloadlinux-stable-e2b348354112df63a9c2ea4219a6867c6c7ea100.tar.gz
linux-stable-e2b348354112df63a9c2ea4219a6867c6c7ea100.tar.bz2
linux-stable-e2b348354112df63a9c2ea4219a6867c6c7ea100.zip
crypto: pcrypt - Fix use after free on padata_free
kobject_put is called from padata_free for the padata kobject. The kobject's release function frees the padata instance, so don't call kobject_put for the padata kobject from pcrypt. Reported-and-tested-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'crypto')
-rw-r--r--crypto/pcrypt.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index de3078215fe6..75586f1f86e7 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -504,7 +504,6 @@ err:
static void pcrypt_fini_padata(struct padata_pcrypt *pcrypt)
{
- kobject_put(&pcrypt->pinst->kobj);
free_cpumask_var(pcrypt->cb_cpumask->mask);
kfree(pcrypt->cb_cpumask);