summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2016-08-25 16:49:51 +0800
committerHerbert Xu <herbert@gondor.apana.org.au>2016-08-31 22:50:40 +0800
commit31bd44e7687be8a70e1e744e5cb84974b798d568 (patch)
tree09a8c2ddfcbd400a1a24772714c047347a1ed899
parent901d3d4fee83e9407d91e7178048e2fed6c91f6b (diff)
downloadlinux-31bd44e7687be8a70e1e744e5cb84974b798d568.tar.gz
linux-31bd44e7687be8a70e1e744e5cb84974b798d568.tar.bz2
linux-31bd44e7687be8a70e1e744e5cb84974b798d568.zip
crypto: cryptd - Use correct tfm object for AEAD tracking
The AEAD code path incorrectly uses the child tfm to track the cryptd refcnt, and then potentially frees the child tfm. Fixes: 81760ea6a95a ("crypto: cryptd - Add helpers to check...") Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
-rw-r--r--crypto/cryptd.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index cf8037a87b2d..77207b41940c 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
rctx = aead_request_ctx(req);
compl = rctx->complete;
+ tfm = crypto_aead_reqtfm(req);
+
if (unlikely(err == -EINPROGRESS))
goto out;
aead_request_set_tfm(req, child);
err = crypt( req );
out:
- tfm = crypto_aead_reqtfm(req);
ctx = crypto_aead_ctx(tfm);
refcnt = atomic_read(&ctx->refcnt);