Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935353AbdDSOj7 (ORCPT ); Wed, 19 Apr 2017 10:39:59 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:46294 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935317AbdDSOjv (ORCPT ); Wed, 19 Apr 2017 10:39:51 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Herbert Xu Subject: [PATCH 4.10 59/69] crypto: lrw - Fix use-after-free on EINPROGRESS Date: Wed, 19 Apr 2017 16:37:28 +0200 Message-Id: <20170419141557.558380681@linuxfoundation.org> X-Mailer: git-send-email 2.12.2 In-Reply-To: <20170419141555.114738231@linuxfoundation.org> References: <20170419141555.114738231@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1579 Lines: 67 4.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Herbert Xu commit 4702bbeefb490e315189636a5588628c1151223d upstream. When we get an EINPROGRESS completion in lrw, we will end up marking the request as done and freeing it. This then blows up when the request is really completed as we've already freed the memory. Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher") Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- crypto/lrw.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) --- a/crypto/lrw.c +++ b/crypto/lrw.c @@ -345,6 +345,13 @@ static void encrypt_done(struct crypto_a struct rctx *rctx; rctx = skcipher_request_ctx(req); + + if (err == -EINPROGRESS) { + if (rctx->left != req->cryptlen) + return; + goto out; + } + subreq = &rctx->subreq; subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; @@ -352,6 +359,7 @@ static void encrypt_done(struct crypto_a if (rctx->left) return; +out: skcipher_request_complete(req, err); } @@ -389,6 +397,13 @@ static void decrypt_done(struct crypto_a struct rctx *rctx; rctx = skcipher_request_ctx(req); + + if (err == -EINPROGRESS) { + if (rctx->left != req->cryptlen) + return; + goto out; + } + subreq = &rctx->subreq; subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; @@ -396,6 +411,7 @@ static void decrypt_done(struct crypto_a if (rctx->left) return; +out: skcipher_request_complete(req, err); }