[PATCH 4.10 59/69] crypto: lrw - Fix use-after-free on EINPROGRESS

Greg Kroah-Hartman
2017-04-19T14:39:59Z

From: Herbert Xu <herbert@gondor.apana.org.au>

commit 4702bbeefb490e315189636a5588628c1151223d upstream.

When we get an EINPROGRESS completion in lrw, we will end up marking
the request as done and freeing it. This then blows up when the
request is really completed as we've already freed the memory.

Fixes: 700cb3f5fe75 ("crypto: lrw - Convert to skcipher")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
crypto/lrw.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

--- a/crypto/lrw.c
+++ b/crypto/lrw.c
@@ -345,6 +345,13 @@ static void encrypt_done(struct crypto_a
struct rctx *rctx;

rctx = skcipher_request_ctx(req);
+
+ if (err == -EINPROGRESS) {
+ if (rctx->left != req->cryptlen)
+ return;
+ goto out;
+ }
+
subreq = &rctx->subreq;
subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;

@@ -352,6 +359,7 @@ static void encrypt_done(struct crypto_a
if (rctx->left)
return;

+out:
skcipher_request_complete(req, err);
}

@@ -389,6 +397,13 @@ static void decrypt_done(struct crypto_a
struct rctx *rctx;

rctx = skcipher_request_ctx(req);
+
+ if (err == -EINPROGRESS) {
+ if (rctx->left != req->cryptlen)
+ return;
+ goto out;
+ }
+
subreq = &rctx->subreq;
subreq->base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG;

@@ -396,6 +411,7 @@ static void decrypt_done(struct crypto_a
if (rctx->left)
return;

+out:
skcipher_request_complete(req, err);
}