]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit - crypto/xts.c
crypto: xts - Fix use-after-free on EINPROGRESS
authorHerbert Xu <herbert@gondor.apana.org.au>
Sat, 8 Apr 2017 02:02:46 +0000 (10:02 +0800)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Wed, 17 May 2017 16:37:50 +0000 (13:37 -0300)
commitc074a2f15d30b578a2b0cdd86351db55f94dad0f
tree81e6162e5203e1924e2595d5281f652949ca7205
parent2c5a1eb2ab904f98d63def7ecdbceb2a136617cd
crypto: xts - Fix use-after-free on EINPROGRESS

BugLink: http://bugs.launchpad.net/bugs/1687045
commit aa4a829bdaced81e70c215a84ef6595ce8bd4308 upstream.

When we get an EINPROGRESS completion in xts, we will end up marking
the request as done and freeing it.  This then blows up when the
request is really completed as we've already freed the memory.

Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
Reported-by: Nathan Royce <nroycea+kernel@gmail.com>
Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
crypto/xts.c