crypto: cryptd - Use correct tfm object for AEAD tracking
authorHerbert Xu <herbert@gondor.apana.org.au>
Thu, 25 Aug 2016 08:49:51 +0000 (16:49 +0800)
committerHerbert Xu <herbert@gondor.apana.org.au>
Wed, 31 Aug 2016 14:50:40 +0000 (22:50 +0800)
The AEAD code path incorrectly uses the child tfm to track the
cryptd refcnt, and then potentially frees the child tfm.

Fixes: 81760ea6a95a ("crypto: cryptd - Add helpers to check...")
Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
crypto/cryptd.c

index cf8037a..77207b4 100644 (file)
@@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
        rctx = aead_request_ctx(req);
        compl = rctx->complete;
 
+       tfm = crypto_aead_reqtfm(req);
+
        if (unlikely(err == -EINPROGRESS))
                goto out;
        aead_request_set_tfm(req, child);
        err = crypt( req );
 
 out:
-       tfm = crypto_aead_reqtfm(req);
        ctx = crypto_aead_ctx(tfm);
        refcnt = atomic_read(&ctx->refcnt);