crypto: af_alg - fix race accessing cipher request
authorStephan Mueller <smueller@chronox.de>
Fri, 8 Dec 2017 10:50:37 +0000 (11:50 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 29 Dec 2017 16:53:46 +0000 (17:53 +0100)
commitf09fca41e29c68944e75ab5f65a2efcfcc88aceb
treeb4bc321f92af229f95df53d850f42407efff5c77
parentc692698ebebed838627aa3879e30959c4a75f033
crypto: af_alg - fix race accessing cipher request

commit d53c5135792319e095bb126bc43b2ee98586f7fe upstream.

When invoking an asynchronous cipher operation, the invocation of the
callback may be performed before the subsequent operations in the
initial code path are invoked. The callback deletes the cipher request
data structure which implies that after the invocation of the
asynchronous cipher operation, this data structure must not be accessed
any more.

The setting of the return code size with the request data structure must
therefore be moved before the invocation of the asynchronous cipher
operation.

Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
crypto/algif_aead.c
crypto/algif_skcipher.c