From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 4 Jan 2019 06:46:11 +0000 (+0300)
Subject: crypto: cavium/nitrox - Use after free in process_response_list()
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=06bbf753476dab23eb262cb5fbab6d6d277a0ba3;p=openwrt%2Fstaging%2Fblogic.git

crypto: cavium/nitrox - Use after free in process_response_list()

We free "sr" and then dereference it on the next line.

Fixes: c9613335bf4f ("crypto: cavium/nitrox - Added AEAD cipher support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---

diff --git a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
index e34e4df8fd24..fe070d75c842 100644
--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
@@ -567,10 +567,10 @@ static void process_response_list(struct nitrox_cmdq *cmdq)
 
 		/* ORH error code */
 		err = READ_ONCE(*sr->resp.orh) & 0xff;
-		softreq_destroy(sr);
 
 		if (sr->callback)
 			sr->callback(sr->cb_arg, err);
+		softreq_destroy(sr);
 
 		req_completed++;
 	}