linux-kernel - Re: [BUGFIX for .32] crypto, gcm, fix another complete call in complete fuction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091103155339.GC9186@gondor.apana.org.au>
Date:	Tue, 3 Nov 2009 10:53:39 -0500
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Huang Ying <ying.huang@...el.com>
Cc:	linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org
Subject: Re: [BUGFIX for .32] crypto, gcm, fix another complete call in
	complete fuction

On Tue, Nov 03, 2009 at 10:40:17AM +0800, Huang Ying wrote:
> The flow of the complete function (xxx_done) in gcm.c is as follow:
> 
> void complete(struct crypto_async_request *areq, int err)
> {
> 	if (!err) {
> 		err = async_next_step();
> 		if (err == -EINPROGRESS || err == -EBUSY)
> 			return;
> 	}
> 
> 	complete_for_next_step(areq, err);
> }
> 
> But *areq may be destroyed in async_next_step(), this makes
> complete_for_next_step() can not work properly. To fix this, one of
> following methods is used for each complete function.

So why is async_next_step destroying areq? Can you give me a
concrete example?

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/