diff options
author | Pan Bian <bianpan2016@163.com> | 2018-11-22 18:00:16 +0800 |
---|---|---|
committer | Herbert Xu <herbert@gondor.apana.org.au> | 2018-11-29 14:53:59 +0800 |
commit | 046f6e8adfd37049d578844eeb06ed093805783b (patch) | |
tree | 9ae22c1a7296af6aa2273683b7805da2296632e0 /crypto/cbc.c | |
parent | f5dc455f1b0548b15904e18be717c6f85f1c446d (diff) | |
download | linux-crypto-046f6e8adfd37049d578844eeb06ed093805783b.tar.gz linux-crypto-046f6e8adfd37049d578844eeb06ed093805783b.zip |
crypto: do not free algorithm before using
In multiple functions, the algorithm fields are read after its reference
is dropped through crypto_mod_put. In this case, the algorithm memory
may be freed, resulting in use-after-free bugs. This patch delays the
put operation until the algorithm is never used.
Fixes: cd89eb27bee6 ("crypto: cbc - Convert to skcipher")
Fixes: df5fcebba63e ("crypto: cfb - add support for Cipher FeedBack mode")
Fixes: 469cb2e223ed ("crypto: pcbc - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to '')
-rw-r--r-- | crypto/cbc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/crypto/cbc.c b/crypto/cbc.c index b761b1f9..dd5f332f 100644 --- a/crypto/cbc.c +++ b/crypto/cbc.c @@ -140,9 +140,8 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb) spawn = skcipher_instance_ctx(inst); err = crypto_init_spawn(spawn, alg, skcipher_crypto_instance(inst), CRYPTO_ALG_TYPE_MASK); - crypto_mod_put(alg); if (err) - goto err_free_inst; + goto err_put_alg; err = crypto_inst_setname(skcipher_crypto_instance(inst), "cbc", alg); if (err) @@ -174,12 +173,15 @@ static int crypto_cbc_create(struct crypto_template *tmpl, struct rtattr **tb) err = skcipher_register_instance(tmpl, inst); if (err) goto err_drop_spawn; + crypto_mod_put(alg); out: return err; err_drop_spawn: crypto_drop_spawn(spawn); +err_put_alg: + crypto_mod_put(alg); err_free_inst: kfree(inst); goto out; |