crypto: pcrypt - fix freeing pcrypt instances
authorEric Biggers <ebiggers@google.com>
Wed, 20 Dec 2017 22:28:25 +0000 (14:28 -0800)
committerHerbert Xu <herbert@gondor.apana.org.au>
Fri, 22 Dec 2017 08:02:47 +0000 (19:02 +1100)
commitd76c68109f37cb85b243a1cf0f40313afd2bae68
tree233b6167cb25abdb06507952a6de831f0d5ce62d
parent203f45003a3d03eea8fa28d74cfc74c354416fdb
crypto: pcrypt - fix freeing pcrypt instances

pcrypt is using the old way of freeing instances, where the ->free()
method specified in the 'struct crypto_template' is passed a pointer to
the 'struct crypto_instance'.  But the crypto_instance is being
kfree()'d directly, which is incorrect because the memory was actually
allocated as an aead_instance, which contains the crypto_instance at a
nonzero offset.  Thus, the wrong pointer was being kfree()'d.

Fix it by switching to the new way to free aead_instance's where the
->free() method is specified in the aead_instance itself.

Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 0496f56065e0 ("crypto: pcrypt - Add support for new AEAD interface")
Cc: <stable@vger.kernel.org> # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
crypto/pcrypt.c