Commit 06bbf753 authored Jan 04, 2019 by Dan Carpenter Committed by Herbert Xu Jan 10, 2019

crypto: cavium/nitrox - Use after free in process_response_list()



We free "sr" and then dereference it on the next line.

Fixes: c9613335 ("crypto: cavium/nitrox - Added AEAD cipher support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent a7773363

drivers/crypto/cavium/nitrox/nitrox_reqmgr.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -567,10 +567,10 @@ static void process_response_list(struct nitrox_cmdq *cmdq)

		/* ORH error code */
		err = READ_ONCE(*sr->resp.orh) & 0xff;
		softreq_destroy(sr);

		if (sr->callback)
		sr->callback(sr->cb_arg, err);
		softreq_destroy(sr);

		req_completed++;
		}

Admin message