Re: [PATCH] crypto: essiv: fix use-after-free in AEAD path

[Herbert Xu]

On Wed, Oct 14, 2026 at 10:23:51PM +0000, Jérémy Jean wrote:
>
> @@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
>  				  essiv_aead_done, req);
>  	aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
>  
> +	assoc = rctx->assoc;
>  	err = enc ? crypto_aead_encrypt(subreq) :
>  		    crypto_aead_decrypt(subreq);
>  
> -	if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
> -		kfree(rctx->assoc);
> +	if (assoc && err != -EINPROGRESS && err != -EBUSY)
> +		kfree(assoc);

Last time this came up Ard asked for the rctx->assoc != NULL test
to be dropped completely.  Could you please do that and resend?

Thanks,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt