summaryrefslogtreecommitdiffstats
path: root/crypto/cbc.c
diff options
context:
space:
mode:
authorPan Bian <bianpan2016@163.com>2018-11-22 18:00:16 +0800
committerHerbert Xu <herbert@gondor.apana.org.au>2018-11-29 14:53:59 +0800
commite5bde04ccce64d808f8b00a489a1fe5825d285cb (patch)
treeff071a695559c7343c9ca04744794332368e0ecd /crypto/cbc.c
parent9f4debe38415583086ce814798eeb864aeb39551 (diff)
downloadlinux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.tar.gz
linux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.tar.bz2
linux-e5bde04ccce64d808f8b00a489a1fe5825d285cb.zip
crypto: do not free algorithm before using
In multiple functions, the algorithm fields are read after its reference is dropped through crypto_mod_put. In this case, the algorithm memory may be freed, resulting in use-after-free bugs. This patch delays the put operation until the algorithm is never used. Fixes: 79c65d179a40 ("crypto: cbc - Convert to skcipher") Fixes: a7d85e06ed80 ("crypto: cfb - add support for Cipher FeedBack mode") Fixes: 043a44001b9e ("crypto: pcbc - Convert to skcipher") Cc: <stable@vger.kernel.org> Signed-off-by: Pan Bian <bianpan2016@163.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/cbc.c')
-rw-r--r--crypto/cbc.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/cbc.c b/crypto/cbc.c
index b761b1f9c6ca..dd5f332fd566 100644
--- a/crypto/cbc.c
+++ b/crypto/cbc.c
@@ -140,9 +140,8 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
spawn = skcipher_instance_ctx(inst);
err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst),
CRYPTO_ALG_TYPE_MASK);
- crypto_mod_put(alg);
if (err)
- goto err_free_inst;
+ goto err_put_alg;
err = crypto_inst_setname(skcipher_crypto_instance(inst), "cbc", alg);
if (err)
@@ -174,12 +173,15 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb)
err = skcipher_register_instance(tmpl, inst);
if (err)
goto err_drop_spawn;
+ crypto_mod_put(alg);
out:
return err;
err_drop_spawn:
crypto_drop_spawn(spawn);
+err_put_alg:
+ crypto_mod_put(alg);
err_free_inst:
kfree(inst);
goto out;