Re: [PATCH v2] crypto: essiv: fix use-after-free in AEAD path
From: Jérémy Jean
Date: Thu Oct 15 2026 - 09:59:09 EST
On 2026-10-15 14:19, Herbert Xu wrote:
On Thu, Oct 15, 2026 at 12:17:43PM +0000, Jérémy Jean wrote:
@@ -247,11 +248,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
essiv_aead_done, req);
aead_request_set_crypt(subreq, src, req->dst, req->cryptlen, req->iv);
+ assoc = rctx->assoc;
err = enc ? crypto_aead_encrypt(subreq) :
crypto_aead_decrypt(subreq);
- if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
- kfree(rctx->assoc);
+ if (err != -EINPROGRESS && err != -EBUSY)
+ kfree(assoc);
There is no need for assoc at all once the rctx->assoc test is
dropped. If the condition is true then rctx cannot have been
freed.
Indeed, you are totally right, this is definitely simpler, thanks.
Do you prefer I resend a v2 or send a v3?
diff --git a/crypto/essiv.c b/crypto/essiv.c
index a47a3eab6935..3505b2769d93 100644
--- a/crypto/essiv.c
+++ b/crypto/essiv.c
@@ -250,7 +250,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc)
err = enc ? crypto_aead_encrypt(subreq) :
crypto_aead_decrypt(subreq);
- if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY)
- kfree(rctx->assoc);
+ if (err != -EINPROGRESS && err != -EBUSY)
+ kfree(rctx->assoc);
return err;
}