crypto: rng - Fix a refcounting bug in crypto_rng_reset()

commit eed74b3eba9eda36d155c11a12b2b4b50c67c1d8 upstream.

We need to decrement this refcounter on these error paths.

Fixes: f7d76e05d058 ("crypto: user - fix use_after_free of struct xxx_request")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/crypto/rng.c b/crypto/rng.c
index 1e21231..1490d21 100644 (file)
--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -37,12 +37,16 @@ int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen)
        crypto_stats_get(alg);
        if (!seed && slen) {
                buf = kmalloc(slen, GFP_KERNEL);
-               if (!buf)
+               if (!buf) {
+                       crypto_alg_put(alg);
                        return -ENOMEM;
+               }
 
                err = get_random_bytes_wait(buf, slen);
-               if (err)
+               if (err) {
+                       crypto_alg_put(alg);
                        goto out;
+               }
                seed = buf;
        }