From: Sasha Levin <sashal@kernel.org>
Date: Mon, 3 Feb 2020 03:01:14 +0000 (-0500)
Subject: fixes for 4.4
X-Git-Tag: v5.5.2~35
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=70f7b0e857150d9c96b52e39ecd0c84db24dfb12;p=thirdparty%2Fkernel%2Fstable-queue.git

fixes for 4.4

Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/queue-4.4/crypto-pcrypt-fix-user-after-free-on-module-unload.patch b/queue-4.4/crypto-pcrypt-fix-user-after-free-on-module-unload.patch
new file mode 100644
index 00000000000..d23ca75b0e8
--- /dev/null
+++ b/queue-4.4/crypto-pcrypt-fix-user-after-free-on-module-unload.patch
@@ -0,0 +1,43 @@
+From de87973ac4454fe9223c35ececdf560ea368a049 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 17:41:31 +0800
+Subject: crypto: pcrypt - Fix user-after-free on module unload
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 07bfd9bdf568a38d9440c607b72342036011f727 ]
+
+On module unload of pcrypt we must unregister the crypto algorithms
+first and then tear down the padata structure.  As otherwise the
+crypto algorithms are still alive and can be used while the padata
+structure is being freed.
+
+Fixes: 5068c7a883d1 ("crypto: pcrypt - Add pcrypt crypto...")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/pcrypt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index a5718c0a3dc4e..1348541da463a 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -505,11 +505,12 @@ static int __init pcrypt_init(void)
+ 
+ static void __exit pcrypt_exit(void)
+ {
++	crypto_unregister_template(&pcrypt_tmpl);
++
+ 	pcrypt_fini_padata(&pencrypt);
+ 	pcrypt_fini_padata(&pdecrypt);
+ 
+ 	kset_unregister(pcrypt_kset);
+-	crypto_unregister_template(&pcrypt_tmpl);
+ }
+ 
+ module_init(pcrypt_init);
+-- 
+2.20.1
+
diff --git a/queue-4.4/series b/queue-4.4/series
index 7b632e78a12..420e527f8b5 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -21,3 +21,4 @@ usb-storage-disable-uas-on-jmicron-sata-enclosure.patch
 net_sched-ematch-reject-invalid-tcf_em_simple.patch
 crypto-af_alg-use-bh_lock_sock-in-sk_destruct.patch
 vfs-fix-do_last-regression.patch
+crypto-pcrypt-fix-user-after-free-on-module-unload.patch