From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751742AbdKVIIu (ORCPT ); Wed, 22 Nov 2017 03:08:50 -0500 Received: from mail-wr0-f194.google.com ([209.85.128.194]:41971 "EHLO mail-wr0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751688AbdKVIIs (ORCPT ); Wed, 22 Nov 2017 03:08:48 -0500 X-Google-Smtp-Source: AGs4zMYTqD/Yzg+BWex37huP5Ra/tzyVLR5HflDD7JAnwyfPY5ml4LnBC6f96Ff+79xpFXiSNrmO7g== From: Corentin Labbe To: herbert@gondor.apana.org.au, davem@davemloft.net, catalin.marinas@arm.com, will.deacon@arm.com Cc: linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Corentin Labbe Subject: [PATCH] crypto: arm64/aes - do not call crypto_unregister_skcipher twice on error Date: Wed, 22 Nov 2017 08:08:34 +0000 Message-Id: <1511338114-39583-1-git-send-email-clabbe@baylibre.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When a cipher fail to register in aes_init(), the error path go thought aes_exit() then crypto_unregister_skciphers(). Since aes_exit calls also crypto_unregister_skcipher, this trigger a refcount_t: underflow; use-after-free. Signed-off-by: Corentin Labbe --- arch/arm64/crypto/aes-glue.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c index 998ba519a026..9e42ec96243e 100644 --- a/arch/arm64/crypto/aes-glue.c +++ b/arch/arm64/crypto/aes-glue.c @@ -664,7 +664,10 @@ static int __init aes_init(void) return 0; unregister_simds: - aes_exit(); + for (i = 0; i < ARRAY_SIZE(aes_simd_algs); i++) + if (aes_simd_algs[i]) + simd_skcipher_free(aes_simd_algs[i]); + crypto_unregister_shashes(mac_algs, ARRAY_SIZE(mac_algs)); unregister_ciphers: crypto_unregister_skciphers(aes_algs, ARRAY_SIZE(aes_algs)); return err; -- 2.13.6