Re: [PATCH v2] crypto: essiv: fix use-after-free in AEAD path

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-10-15 14:19, Herbert Xu wrote:
> On Thu, Oct 15, 2026 at 12:17:43PM +0000, Jérémy Jean wrote:
>> 
>> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request 
>> *req, bool enc)
>>  				  essiv_aead_done, req);
>>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, 
>> req->iv);
>> 
>> +	assoc = rctx->assoc;
>>  	err = enc ? crypto_aead_encrypt(subreq) :
>>  		    crypto_aead_decrypt(subreq);
>> 
>> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
>> -		kfree(rctx->assoc);
>> +	if (err != -EINPROGRESS && err != -EBUSY)
>> +		kfree(assoc);
> 
> There is no need for assoc at all once the rctx->assoc test is
> dropped.  If the condition is true then rctx cannot have been
> freed.

Indeed, you are totally right, this is definitely simpler, thanks.
Do you prefer I resend a v2 or send a v3?

diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..3505b2769d93 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -250,7 +250,7 @@ static int essiv_aead_crypt(struct aead_request 
*req, bool enc)
         err = enc ? crypto_aead_encrypt(subreq) :
                     crypto_aead_decrypt(subreq);

-       if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
-               kfree(rctx->assoc);
+       if (err != -EINPROGRESS && err != -EBUSY)
+               kfree(rctx->assoc);
         return err;
  }