summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXiaodong Liu <xiaodong.liu@intel.com>2016-04-12 09:45:51 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-05-04 14:48:44 -0700
commit9a10dfc8bf95270073c6c2e2be3de26a652d730a (patch)
tree15d67c3d1327c1f2b52f2f74c6311cf48d29b8d8
parent1575fcd167e3452cadbcf7d04ad6277c875a482f (diff)
crypto: sha1-mb - use corrcet pointer while completing jobs
commit 0851561d9c965df086ef8a53f981f5f95a57c2c8 upstream. In sha_complete_job, incorrect mcryptd_hash_request_ctx pointer is used when check and complete other jobs. If the memory of first completed req is freed, while still completing other jobs in the func, kernel will crash since NULL pointer is assigned to RIP. Signed-off-by: Xiaodong Liu <xiaodong.liu@intel.com> Acked-by: Tim Chen <tim.c.chen@linux.intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--arch/x86/crypto/sha-mb/sha1_mb.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
index a841e9765bd6..8381c09d2870 100644
--- a/arch/x86/crypto/sha-mb/sha1_mb.c
+++ b/arch/x86/crypto/sha-mb/sha1_mb.c
@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
req = cast_mcryptd_ctx_to_req(req_ctx);
if (irqs_disabled())
- rctx->complete(&req->base, ret);
+ req_ctx->complete(&req->base, ret);
else {
local_bh_disable();
- rctx->complete(&req->base, ret);
+ req_ctx->complete(&req->base, ret);
local_bh_enable();
}
}