crypto: xts - Fix use-after-free on EINPROGRESS
authorHerbert Xu <herbert@gondor.apana.org.au>
Sat, 8 Apr 2017 02:02:46 +0000 (10:02 +0800)
committerHerbert Xu <herbert@gondor.apana.org.au>
Mon, 10 Apr 2017 11:09:17 +0000 (19:09 +0800)
commitaa4a829bdaced81e70c215a84ef6595ce8bd4308
treebd43c4cb8887df86b71b5be81bcdd4d555188ea1
parent40c98cb57cdbc377456116ad4582c89e329721b0
crypto: xts - Fix use-after-free on EINPROGRESS

When we get an EINPROGRESS completion in xts, we will end up marking
the request as done and freeing it.  This then blows up when the
request is really completed as we've already freed the memory.

Fixes: f1c131b45410 ("crypto: xts - Convert to skcipher")
Cc: <stable@vger.kernel.org>
Reported-by: Nathan Royce <nroycea+kernel@gmail.com>
Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
crypto/xts.c