| From: Herbert Xu <herbert@gondor.apana.org.au> |
| Date: Tue, 19 Nov 2019 17:41:31 +0800 |
| Subject: crypto: pcrypt - Fix user-after-free on module unload |
| |
| commit 07bfd9bdf568a38d9440c607b72342036011f727 upstream. |
| |
| On module unload of pcrypt we must unregister the crypto algorithms |
| first and then tear down the padata structure. As otherwise the |
| crypto algorithms are still alive and can be used while the padata |
| structure is being freed. |
| |
| Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto...") |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| [bwh: Backported to 3.16: adjust context] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| crypto/pcrypt.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/crypto/pcrypt.c |
| +++ b/crypto/pcrypt.c |
| @@ -552,11 +552,12 @@ err: |
| |
| static void __exit pcrypt_exit(void) |
| { |
| + crypto_unregister_template(&pcrypt_tmpl); |
| + |
| pcrypt_fini_padata(&pencrypt); |
| pcrypt_fini_padata(&pdecrypt); |
| |
| kset_unregister(pcrypt_kset); |
| - crypto_unregister_template(&pcrypt_tmpl); |
| } |
| |
| module_init(pcrypt_init); |