Commit 5da472ae authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v6.15-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 

Pull crypto fixes from Herbert Xu:
 "This fixes a regression in padata as well as an ancient double-free
  bug in af_alg"

* tag 'v6.15-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: algif_hash - fix double free in hash_accept
  padata: do not leak refcount in reorder_work
parents b36ddb92 b2df03ed

crypto/algif_hash.c

+0 −4
Original line number Diff line number Diff line
@@ -265,10 +265,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, 
		goto out_free_state;



	err = crypto_ahash_import(&ctx2->req, state);

	if (err) {

		sock_orphan(sk2);

		sock_put(sk2);

	}



out_free_state:

	kfree_sensitive(state);

kernel/padata.c

+2 −1
Original line number Diff line number Diff line
@@ -358,7 +358,8 @@ static void padata_reorder(struct parallel_data *pd) 
		 * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish.

		 */

		padata_get_pd(pd);

		queue_work(pinst->serial_wq, &pd->reorder_work);

		if (!queue_work(pinst->serial_wq, &pd->reorder_work))

			padata_put_pd(pd);

	}

}