Commit e0d3b845 authored by Dan Carpenter's avatar Dan Carpenter Committed by Herbert Xu
Browse files

crypto: iaa - Fix potential use after free bug 



The free_device_compression_mode(iaa_device, device_mode) function frees
"device_mode" but it iss passed to iaa_compression_modes[i]->free() a few
lines later resulting in a use after free.

The good news is that, so far as I can tell, nothing implements the
->free() function and the use after free happens in dead code.  But, with
this fix, when something does implement it, we'll be ready.  :)

Fixes: b190447e ("crypto: iaa - Add compression mode management along with fixed mode")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarTom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 2fc99058

drivers/crypto/intel/iaa/iaa_crypto_main.c

+2 −2
Original line number Diff line number Diff line
@@ -495,10 +495,10 @@ static void remove_device_compression_modes(struct iaa_device *iaa_device) 
		if (!device_mode)

			continue;



		free_device_compression_mode(iaa_device, device_mode);

		iaa_device->compression_modes[i] = NULL;

		if (iaa_compression_modes[i]->free)

			iaa_compression_modes[i]->free(device_mode);

		free_device_compression_mode(iaa_device, device_mode);

		iaa_device->compression_modes[i] = NULL;

	}

}