From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752282AbdKXIWR (ORCPT ); Fri, 24 Nov 2017 03:22:17 -0500 Received: from mail-wr0-f195.google.com ([209.85.128.195]:37767 "EHLO mail-wr0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751631AbdKXIWP (ORCPT ); Fri, 24 Nov 2017 03:22:15 -0500 X-Google-Smtp-Source: AGs4zMZrQByykEeDIYOyRAai0LmBmk9tswDEJvSLNX2ZTNop7aruu29FASg18JpbDMy6pjS8cg7fdA== From: Corentin Labbe To: herbert@gondor.apana.org.au, davem@davemloft.net, catalin.marinas@arm.com, will.deacon@arm.com, ard.biesheuvel@linaro.org Cc: linux-crypto@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Corentin Labbe Subject: [PATCH v2] ARM64: crypto: do not call crypto_unregister_skcipher twice on error Date: Fri, 24 Nov 2017 08:22:07 +0000 Message-Id: <1511511727-15385-1-git-send-email-clabbe@baylibre.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When a cipher fails to register in aes_init(), the error path goes thought aes_exit() then crypto_unregister_skciphers(). Since aes_exit calls also crypto_unregister_skcipher, this triggers a refcount_t: underflow; use-after-free. Signed-off-by: Corentin Labbe --- Changes since v1: - Instead of duplicate code from aes_exit() minus crypto_unregister_skciphers, simply use it and return after as suggested by Ard Biesheuvel arch/arm64/crypto/aes-glue.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c index 998ba519a026..2fa850e86aa8 100644 --- a/arch/arm64/crypto/aes-glue.c +++ b/arch/arm64/crypto/aes-glue.c @@ -665,6 +665,7 @@ static int __init aes_init(void) unregister_simds: aes_exit(); + return err; unregister_ciphers: crypto_unregister_skciphers(aes_algs, ARRAY_SIZE(aes_algs)); return err; -- 2.13.6