Commit aa4a829b authored by Herbert Xu's avatar Herbert Xu

crypto: xts - Fix use-after-free on EINPROGRESS

When we get an EINPROGRESS completion in xts, we will end up marking
the request as done and freeing it.  This then blows up when the
request is really completed as we've already freed the memory.

Fixes: f1c131b4 ("crypto: xts - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Reported-by: default avatarNathan Royce <nroycea+kernel@gmail.com>
Reported-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Tested-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
parent 40c98cb5
...@@ -286,6 +286,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err) ...@@ -286,6 +286,13 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
struct rctx *rctx; struct rctx *rctx;
rctx = skcipher_request_ctx(req); rctx = skcipher_request_ctx(req);
if (err == -EINPROGRESS) {
if (rctx->left != req->cryptlen)
return;
goto out;
}
subreq = &rctx->subreq; subreq = &rctx->subreq;
subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
...@@ -293,6 +300,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err) ...@@ -293,6 +300,7 @@ static void encrypt_done(struct crypto_async_request *areq, int err)
if (rctx->left) if (rctx->left)
return; return;
out:
skcipher_request_complete(req, err); skcipher_request_complete(req, err);
} }
...@@ -330,6 +338,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err) ...@@ -330,6 +338,13 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
struct rctx *rctx; struct rctx *rctx;
rctx = skcipher_request_ctx(req); rctx = skcipher_request_ctx(req);
if (err == -EINPROGRESS) {
if (rctx->left != req->cryptlen)
return;
goto out;
}
subreq = &rctx->subreq; subreq = &rctx->subreq;
subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;
...@@ -337,6 +352,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err) ...@@ -337,6 +352,7 @@ static void decrypt_done(struct crypto_async_request *areq, int err)
if (rctx->left) if (rctx->left)
return; return;
out:
skcipher_request_complete(req, err); skcipher_request_complete(req, err);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment