Commit 1605b847 authored by Herbert Xu's avatar Herbert Xu
Browse files

[CRYPTO] cryptomgr: Fix use after free



By the time kthread_run returns the param may have already been freed
so writing the returned thread_struct pointer to param is wrong.

In fact, we don't need it in param anyway so this patch simply puts it
on the stack.
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent f6259dea
...@@ -24,8 +24,6 @@ ...@@ -24,8 +24,6 @@
#include "internal.h" #include "internal.h"
struct cryptomgr_param { struct cryptomgr_param {
struct task_struct *thread;
struct rtattr *tb[CRYPTOA_MAX]; struct rtattr *tb[CRYPTOA_MAX];
struct { struct {
...@@ -81,6 +79,7 @@ err: ...@@ -81,6 +79,7 @@ err:
static int cryptomgr_schedule_probe(struct crypto_larval *larval) static int cryptomgr_schedule_probe(struct crypto_larval *larval)
{ {
struct task_struct *thread;
struct cryptomgr_param *param; struct cryptomgr_param *param;
const char *name = larval->alg.cra_name; const char *name = larval->alg.cra_name;
const char *p; const char *p;
...@@ -130,8 +129,8 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval) ...@@ -130,8 +129,8 @@ static int cryptomgr_schedule_probe(struct crypto_larval *larval)
memcpy(param->larval.name, larval->alg.cra_name, CRYPTO_MAX_ALG_NAME); memcpy(param->larval.name, larval->alg.cra_name, CRYPTO_MAX_ALG_NAME);
param->thread = kthread_run(cryptomgr_probe, param, "cryptomgr"); thread = kthread_run(cryptomgr_probe, param, "cryptomgr");
if (IS_ERR(param->thread)) if (IS_ERR(thread))
goto err_free_param; goto err_free_param;
return NOTIFY_STOP; return NOTIFY_STOP;
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment