crypto: cryptd - Use correct tfm object for AEAD tracking
The AEAD code path incorrectly uses the child tfm to track the
cryptd refcnt, and then potentially frees the child tfm.
Fixes: 81760ea6a9
("crypto: cryptd - Add helpers to check...")
Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
parent
901d3d4fee
commit
31bd44e768
|
@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
|
||||||
rctx = aead_request_ctx(req);
|
rctx = aead_request_ctx(req);
|
||||||
compl = rctx->complete;
|
compl = rctx->complete;
|
||||||
|
|
||||||
|
tfm = crypto_aead_reqtfm(req);
|
||||||
|
|
||||||
if (unlikely(err == -EINPROGRESS))
|
if (unlikely(err == -EINPROGRESS))
|
||||||
goto out;
|
goto out;
|
||||||
aead_request_set_tfm(req, child);
|
aead_request_set_tfm(req, child);
|
||||||
err = crypt( req );
|
err = crypt( req );
|
||||||
|
|
||||||
out:
|
out:
|
||||||
tfm = crypto_aead_reqtfm(req);
|
|
||||||
ctx = crypto_aead_ctx(tfm);
|
ctx = crypto_aead_ctx(tfm);
|
||||||
refcnt = atomic_read(&ctx->refcnt);
|
refcnt = atomic_read(&ctx->refcnt);
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue