| From b0a482691710b1c192bf7b0d1af13a93a08e82bc Mon Sep 17 00:00:00 2001 |
| From: Herbert Xu <herbert@gondor.apana.org.au> |
| Date: Tue, 19 Nov 2019 17:41:31 +0800 |
| Subject: [PATCH] crypto: pcrypt - Fix user-after-free on module unload |
| |
| commit 07bfd9bdf568a38d9440c607b72342036011f727 upstream. |
| |
| On module unload of pcrypt we must unregister the crypto algorithms |
| first and then tear down the padata structure. As otherwise the |
| crypto algorithms are still alive and can be used while the padata |
| structure is being freed. |
| |
| Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto...") |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c |
| index 0edf5b54fc77..b3d2bc516824 100644 |
| --- a/crypto/pcrypt.c |
| +++ b/crypto/pcrypt.c |
| @@ -493,11 +493,12 @@ static int __init pcrypt_init(void) |
| |
| static void __exit pcrypt_exit(void) |
| { |
| + crypto_unregister_template(&pcrypt_tmpl); |
| + |
| pcrypt_fini_padata(&pencrypt); |
| pcrypt_fini_padata(&pdecrypt); |
| |
| kset_unregister(pcrypt_kset); |
| - crypto_unregister_template(&pcrypt_tmpl); |
| } |
| |
| subsys_initcall(pcrypt_init); |
| -- |
| 2.7.4 |
| |
