projects/linux·commit 5da472ae

Merge tag 'v6.15-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

5da472ae · Linus Torvalds <[email protected]> · 2025-05-20 20:10:01 -07:00

Pull crypto fixes from Herbert Xu:
 "This fixes a regression in padata as well as an ancient double-free
  bug in af_alg"

* tag 'v6.15-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: algif_hash - fix double free in hash_accept
  padata: do not leak refcount in reorder_work
Commit
5da472ae1f128840b27795fa461b47a85d882ce2
Parents
b36ddb92 · b2df03ed

Merge commit. Changes below are compared with the first parent: b36ddb92.

Changes

2 files changed · +2 −5

FileStatusAddDelContent
crypto/algif_hash.cmodified+0−4View file
kernel/padata.cmodified+2−1View file

crypto/algif_hash.c

View file
diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 5498a87..e3f1a48 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -265,10 +265,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock,
goto out_free_state;
err = crypto_ahash_import(&ctx2->req, state);
- if (err) {
- sock_orphan(sk2);
- sock_put(sk2);
- }
out_free_state:
kfree_sensitive(state);

kernel/padata.c

View file
diff --git a/kernel/padata.c b/kernel/padata.c
index b3d4eac..7eee941 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -358,7 +358,8 @@ static void padata_reorder(struct parallel_data *pd)
* To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish.
*/
padata_get_pd(pd);
- queue_work(pinst->serial_wq, &pd->reorder_work);
+ if (!queue_work(pinst->serial_wq, &pd->reorder_work))
+ padata_put_pd(pd);
}
}