crypto: cryptd - Use correct tfm object for AEAD tracking

The AEAD code path incorrectly uses the child tfm to track the cryptd refcnt, and then potentially frees the child tfm. Fixes: 81760ea ("crypto: cryptd - Add helpers to check...") Reported-by: Sowmini Varadhan <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
oohal · Aug 31, 2016 · 31bd44e · 31bd44e
1 parent 901d3d4
commit 31bd44e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
@@ -733,13 +733,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
 	rctx = aead_request_ctx(req);
 	compl = rctx->complete;
 
+	tfm = crypto_aead_reqtfm(req);
+
 	if (unlikely(err == -EINPROGRESS))
 		goto out;
 	aead_request_set_tfm(req, child);
 	err = crypt( req );
 
 out:
-	tfm = crypto_aead_reqtfm(req);
 	ctx = crypto_aead_ctx(tfm);
 	refcnt = atomic_read(&ctx->refcnt);