crypto: pcrypt - Fix user-after-free on module unload

[mirror_ubuntu-bionic-kernel.git] / crypto / cryptd.c

diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index bd43cf5be14ced190c188f04e68bf73908c46ca7..f0827f8e9be53d4210288e939b082525486cba81 100644 (file)
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -583,6 +583,7 @@ static void cryptd_skcipher_free(struct skcipher_instance *inst)
        struct skcipherd_instance_ctx *ctx = skcipher_instance_ctx(inst);
 
        crypto_drop_skcipher(&ctx->spawn);
+       kfree(inst);
 }
 
 static int cryptd_create_skcipher(struct crypto_template *tmpl,
@@ -893,10 +894,9 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
        if (err)
                goto out_free_inst;
 
-       type = CRYPTO_ALG_ASYNC;
-       if (alg->cra_flags & CRYPTO_ALG_INTERNAL)
-               type |= CRYPTO_ALG_INTERNAL;
-       inst->alg.halg.base.cra_flags = type;
+       inst->alg.halg.base.cra_flags = CRYPTO_ALG_ASYNC |
+               (alg->cra_flags & (CRYPTO_ALG_INTERNAL |
+                                  CRYPTO_ALG_OPTIONAL_KEY));
 
        inst->alg.halg.digestsize = salg->digestsize;
        inst->alg.halg.statesize = salg->statesize;
@@ -911,7 +911,8 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
        inst->alg.finup  = cryptd_hash_finup_enqueue;
        inst->alg.export = cryptd_hash_export;
        inst->alg.import = cryptd_hash_import;
-       inst->alg.setkey = cryptd_hash_setkey;
+       if (crypto_shash_alg_has_setkey(salg))
+               inst->alg.setkey = cryptd_hash_setkey;
        inst->alg.digest = cryptd_hash_digest_enqueue;
 
        err = ahash_register_instance(tmpl, inst);