Commit c0afb6b8 authored by Herbert Xu's avatar Herbert Xu
Browse files

crypto: rk3288 - Fix use after free in unprepare 



The unprepare call must be carried out before the finalize call
as the latter can free the request.

Fixes: c66c17a0 ("crypto: rk3288 - Remove prepare/unprepare request")
Reported-by: default avatarAndrey Skvortsov <andrej.skvortzov@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: default avatarAndrey Skvortsov <andrej.skvortzov@gmail.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 18342003

drivers/crypto/rockchip/rk3288_crypto_ahash.c

+2 −2
Original line number Diff line number Diff line
@@ -332,12 +332,12 @@ static int rk_hash_run(struct crypto_engine *engine, void *breq) 
theend:

	pm_runtime_put_autosuspend(rkc->dev);



	rk_hash_unprepare(engine, breq);



	local_bh_disable();

	crypto_finalize_hash_request(engine, breq, err);

	local_bh_enable();



	rk_hash_unprepare(engine, breq);



	return 0;

}