| From 8956a033556ad10c288cf6346f464a4521c45570 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Mon, 20 Jan 2020 17:38:04 +0300 |
| Subject: [PATCH] crypto: rng - Fix a refcounting bug in crypto_rng_reset() |
| |
| commit eed74b3eba9eda36d155c11a12b2b4b50c67c1d8 upstream. |
| |
| We need to decrement this refcounter on these error paths. |
| |
| Fixes: f7d76e05d058 ("crypto: user - fix use_after_free of struct xxx_request") |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Acked-by: Neil Horman <nhorman@tuxdriver.com> |
| Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/crypto/rng.c b/crypto/rng.c |
| index 1e21231f71c9..1490d210f1a1 100644 |
| --- a/crypto/rng.c |
| +++ b/crypto/rng.c |
| @@ -37,12 +37,16 @@ int crypto_rng_reset(struct crypto_rng *tfm, const u8 *seed, unsigned int slen) |
| crypto_stats_get(alg); |
| if (!seed && slen) { |
| buf = kmalloc(slen, GFP_KERNEL); |
| - if (!buf) |
| + if (!buf) { |
| + crypto_alg_put(alg); |
| return -ENOMEM; |
| + } |
| |
| err = get_random_bytes_wait(buf, slen); |
| - if (err) |
| + if (err) { |
| + crypto_alg_put(alg); |
| goto out; |
| + } |
| seed = buf; |
| } |
| |
| -- |
| 2.7.4 |
| |
