crypto: cavium/nitrox - Use after free in process_response_list()

Dan Carpenter · herbertx · commit 06bbf753476d · 2019-01-10T21:37:31.000+08:00
We free "sr" and then dereference it on the next line. Fixes: c961333 ("crypto: cavium/nitrox - Added AEAD cipher support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -567,10 +567,10 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
 
 		/* ORH error code */
 		err = READ_ONCE(*sr->resp.orh) & 0xff;
-		softreq_destroy(sr);
 
 		if (sr->callback)
 			sr->callback(sr->cb_arg, err);
+		softreq_destroy(sr);
 
 		req_completed++;
 	}

Original file line number	Diff line number	Diff line change
`@@ -567,10 +567,10 @@ static void process_response_list(struct nitrox_cmdq *cmdq)`
`567`	`567`
`568`	`568`	`/* ORH error code */`
`569`	`569`	`err = READ_ONCE(*sr->resp.orh) & 0xff;`
`570`		`- softreq_destroy(sr);`
`571`	`570`
`572`	`571`	`if (sr->callback)`
`573`	`572`	`sr->callback(sr->cb_arg, err);`
	`573`	`+ softreq_destroy(sr);`
`574`	`574`
`575`	`575`	`req_completed++;`
`576`	`576`	`}`