Re: [PATCH] crypto: essiv: fix use-after-free in AEAD path

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-10-15 05:38, Herbert Xu wrote:
> On Wed, Oct 14, 2026 at 10:23:51PM +0000, Jérémy Jean wrote:
>> 
>> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request 
>> *req, bool enc)
>>  				  essiv_aead_done, req);
>>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, 
>> req->iv);
>> 
>> +	assoc = rctx->assoc;
>>  	err = enc ? crypto_aead_encrypt(subreq) :
>>  		    crypto_aead_decrypt(subreq);
>> 
>> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
>> -		kfree(rctx->assoc);
>> +	if (assoc && err != -EINPROGRESS && err != -EBUSY)
>> +		kfree(assoc);
> 
> Last time this came up Ard asked for the rctx->assoc != NULL test
> to be dropped completely.  Could you please do that and resend?

Hello,

Thanks for the feedback.
I have updated the patch, and will send a v2 shortly.

Regards,
Jérémy