diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-01-20 17:38:04 +0300 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2020-02-13 16:58:09 +0800 |
| commit | 9b91cc7900ce35b2e7e835726faa6295120cf839 (patch) | |
| tree | 83bc1f3e01d58e87356728881033e6c563a743fd /crypto | |
| parent | 7f9d45f5936dcb2664148abb79ff8419c99e889b (diff) | |
| download | linux-crypto-9b91cc7900ce35b2e7e835726faa6295120cf839.tar.gz linux-crypto-9b91cc7900ce35b2e7e835726faa6295120cf839.zip | |
crypto: rng - Fix a refcounting bug in crypto_rng_reset()
We need to decrement this refcounter on these error paths.
Fixes: 69bd3f459030 ("crypto: user - fix use_after_free of struct xxx_request")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/rng.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/crypto/rng.c b/crypto/rng.c index 1e21231f..1490d210 100644 --- a/crypto/rng.c +++ b/crypto/rng.c @@ -37,12 +37,16 @@ int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen) crypto_stats_get(alg); if (!seed && slen) { buf = kmalloc(slen, GFP_KERNEL); - if (!buf) + if (!buf) { + crypto_alg_put(alg); return -ENOMEM; + } err = get_random_bytes_wait(buf, slen); - if (err) + if (err) { + crypto_alg_put(alg); goto out; + } seed = buf; } |