• Eric Biggers's avatar
    crypto: pcrypt - fix freeing pcrypt instances · d76c6810
    Eric Biggers authored
    pcrypt is using the old way of freeing instances, where the ->free()
    method specified in the 'struct crypto_template' is passed a pointer to
    the 'struct crypto_instance'.  But the crypto_instance is being
    kfree()'d directly, which is incorrect because the memory was actually
    allocated as an aead_instance, which contains the crypto_instance at a
    nonzero offset.  Thus, the wrong pointer was being kfree()'d.
    
    Fix it by switching to the new way to free aead_instance's where the
    ->free() method is specified in the aead_instance itself.
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Fixes: 0496f560 ("crypto: pcrypt - Add support for new AEAD interface")
    Cc: <stable@vger.kernel.org> # v4.2+
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    d76c6810
pcrypt.c 13.2 KB