lkml.org 
[lkml]   [2017]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 4.10 59/69] crypto: lrw - Fix use-after-free on EINPROGRESS
Date
4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

commit 4702bbeefb490e315189636a5588628c1151223d upstream.

When we get an EINPROGRESS completion in lrw, we will end up marking
the request as done and freeing it. This then blows up when the
request is really completed as we've already freed the memory.

Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
crypto/lrw.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -345,6 +345,13 @@ static void encrypt_done(struct crypto_a
struct rctx *rctx;

rctx = skcipher_request_ctx(req);
+
+ if (err == -EINPROGRESS) {
+ if (rctx->left != req->cryptlen)
+ return;
+ goto out;
+ }
+
subreq = &rctx->subreq;
subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;

@@ -352,6 +359,7 @@ static void encrypt_done(struct crypto_a
if (rctx->left)
return;

+out:
skcipher_request_complete(req, err);
}

@@ -389,6 +397,13 @@ static void decrypt_done(struct crypto_a
struct rctx *rctx;

rctx = skcipher_request_ctx(req);
+
+ if (err == -EINPROGRESS) {
+ if (rctx->left != req->cryptlen)
+ return;
+ goto out;
+ }
+
subreq = &rctx->subreq;
subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;

@@ -396,6 +411,7 @@ static void decrypt_done(struct crypto_a
if (rctx->left)
return;

+out:
skcipher_request_complete(req, err);
}


\
 
 \ /
  Last update: 2017-04-19 16:40    [W:0.573 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site